# Forensic container observation worksheet

Student and operator:
Lab ID and run folder:
Date, UTC start/end and clock uncertainty:
VM, OS, kernel, filesystem and mount options:
Tool versions:
Authorized synthetic source and collection scope:

## Original evidence review
Windows source row or screenshot:
Observed operation and values:
Corroborating MFT/USN rows:
Supported conclusion:
Limitation:

Ubuntu source and destination log names:
Content hash comparison:
Identity comparison including filesystem/device:
Timestamp comparison including offsets:
Supported conclusion:
Limitation:

## New container run
Source state before hashing:
Source state after hashing:
Archive member inventory and omissions:
Container SHA256:
Independent receipt holder, time and reference:
Transfer method, sender, receiver and destination:
Received container hash and comparison result:
Extraction location:
Extracted content verification:
Metadata differences and explanations:
Screenshots and corresponding raw records:
Errors, skipped operations and deviations:

## Final finding
State exactly which content and metadata you compared, which checks passed, which gaps remain, and what you did not establish.

## Knowledge checks

1. Why can a matching hash coexist with a new birth time?
2. What must you capture before hashing, and why capture state again afterward?
3. Which properties does scp -p request, and what does it not preserve?
4. How does a TAR file collection differ from a full filesystem acquisition?
5. Which MFT/USN fields and event context support the controlled rename finding?
6. Why does a backdated timestamp alone not establish malicious intent?
7. Why preserve and verify the received archive before extracting its contents?

Answer using the command IDs and your records. Do not overwrite the historical workbook.