WINDOWS FORENSIC CLAIMS VALIDATION - INSTRUCTOR PRE-VALIDATION

This is the validation harness used BEFORE finalizing the student-facing forensic claims.

RECOMMENDED
- Windows 11
- NTFS volume
- PowerShell 7 preferred (5.1 supported)
- Run PowerShell as Administrator when possible
- Robocopy available

RUN
1. Extract this package.
2. Open PowerShell 7 as Administrator.
3. cd to the extracted folder.
4. Run:

   Set-ExecutionPolicy -Scope Process Bypass -Force
   .\Windows_Forensic_Claims_Validation.ps1

WHAT IT TESTS
- Windows time service and LastAccessTime policy
- Get-FileHash read behavior
- Copy-Item
- Copy-Item -Force
- Robocopy /COPY:DAT
- Robocopy /COPYALL and ACL/SDDL comparison
- Same-volume rename
- Final source SHA-256 integrity

STATUS
PASS      = integrity requirement succeeded
OBSERVED  = actual behavior measured
WARNING   = environment/policy dependency
FAIL      = integrity/command requirement failed

OUTPUT
The script prints a timestamped run folder. ZIP that ENTIRE folder and upload it.
Key files:
- Forensic_Claims_Matrix.csv
- Forensic_Claims_Matrix.json
- README_RESULTS.txt
- LOGS\validation_transcript.txt
- LOGS\robocopy_DAT.log
- LOGS\robocopy_COPYALL.log

SAFETY
The script creates and manipulates only synthetic test files inside its own TEMP workspace.
Do NOT point it at actual evidence.
