From exhibit to certificate, without a wrong turn.

1How to get there

Home opens on the case workbench. The examination itself spans several workspaces; this is where it starts and ends.

11. The image or extraction is hashed on the way in. That hash anchors everything after.22. The examination loop: verify, timeline, memory, artefacts, search.33. The published order - acquire, verify, analyse, report - kept as a checklist, not a rail.44. The intake sheet for the physical case file.

1. 1Add an exhibit add an exhibit - it is hashed on the way in.
2. 2What's next the guided next step through the investigator loop.
3. 3The checklist the standing-order checklist for the whole examination.
4. 4Print sheet print the intake sheet for the paper file.

2AI: which mode, and when

3The options that seal the case

4Step by step

1. Set the bench to forensic mode
   This hashes every item and writes the manifest. Do it before any acquisition or scan.
2. Open or create the case
   A case seals its exhibits and records who did what, when.
3. Add the exhibit
   The image or extraction is hashed on the way in; the hash is the anchor for everything after.
4. Verify before you analyse
   Verification sits between acquisition and analysis so every finding rests on a checked copy.
5. Work the loop
   Timeline, memory, artefacts, keyword search - each writes to the case, not to a scratchpad.
6. Seal your reading, then reveal any AI
   The examiner's own conclusion is recorded first; only then is an AI observation shown, and it stays an observation.
7. Report
   The CASE-UCO export and the S.63(4) BSA-2023 certificate, generated from what the case actually holds.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. The image, folder or extraction to bring into the case.22. Enqueues the source; it is hashed as it enters.33. Runs the stages in order with a live dashboard.44. Halts at a stage boundary, never mid-stage, so nothing is half-processed.

1. 1Source path the source to add to the case queue.
2. 2Add enqueue the source for the pipeline.
3. 3Run queued stages run the pipeline stages with live progress.
4. 4Stop halt at a stage boundary, cleanly.

2The commands, and when to use them

3Step by step

1. Add the source
   Point at the image, folder or extraction. It is hashed as it enters the case.
2. Run the queued stages
   The pipeline processes each stage in order, writing progress to the dashboard.
3. Watch the dashboard
   The queue and its live progress are on one screen; a stalled figure is a display fault, never silent.
4. Stop at a boundary if you must
   A stop lands between stages, so the case never holds a partly processed exhibit.
5. Retry a failed stage
   Fix the cause, then re-queue only the stage that failed.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Registry hive, plist, SQLite, database or hex - pick what the artefact is.22. The artefact file to open in the viewer.33. For the registry viewer, the key path to open.44. Opens the artefact structured, without leaving the case.

1. 1Viewer kind choose the viewer for the artefact in hand.
2. 2Path the artefact file to open.
3. 3A hive key the registry key to open, for the hive viewer.
4. 4Open open the artefact in the structured viewer.

2The viewers, and what each is for

3Step by step

1. Pick the viewer for the artefact
   Registry, plist, SQLite, hex - the kind follows what the file is, not what it is named.
2. Open the file
   It opens structured, inside the case, and every view prints JSON so a result can travel.
3. Read the structure
   Keys, rows, property pairs - and for SQLite, the deleted rows a normal reader would not show.
4. Interpret a field if you must
   Decode the bytes at an offset as a timestamp or integer rather than guessing.
5. Bookmark what a finding rests on
   Mark the exact bytes into the case so the report can cite the offset, not a screenshot.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Keep exhibits by camera make and model, or by file extension.22. All media, images only, or videos only.33. Newest, largest or by name.44. Unknown, known-good or known-bad - reads unknown until a hash set is installed.

1. 1Camera / extension filter by camera or by file type.
2. 2Media kind show all media, images, or videos.
3. 3Sort order the wall by date, size or name.
4. 4Known status filter by known-file status from a hash set.

2The filters, and what to set them to

3The lightbox

Open a tile to see the image full, with its SHA-256, and the tagging that writes to the case.

11. Return to the wall.22. A tag or note for this exhibit, written to the case.33. Promote the exhibit into a case finding.

1. 1Close close the lightbox.
2. 2Tag or note write a tag or note onto the exhibit.
3. 3Add to finding add the exhibit to a finding.

4Step by step

1. Open the gallery on the case
   The wall shows every carved and extracted image and video. Omit the case to read the most recent one.
2. Narrow to what matters
   By kind, camera, extension, date, size or tag. The count stays the full filtered total, so paging never hides how much matched.
3. Open a tile in the lightbox
   The image opens full with its SHA-256; a video has a frame stepper.
4. Tag it or add it to a finding
   A tag or note is written to the case; adding to a finding promotes it, through the case's own door.
5. Classify against a hash set
   Install a hash set to turn the known-file column from unknown into known-good or known-bad.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. All media, images or videos to plot.22. Bound the points to a period.33. Export the points as GeoJSON (RFC 7946).44. Export as KML, which opens in Google Earth.

1. 1Media kind choose which media to map.
2. 2Date range bound the points by date.
3. 3GeoJSON export as GeoJSON for QGIS or a web map.
4. 4KML export as KML for Google Earth.

2The commands, and what each is for

3Step by step

1. Plot the points
   The map shows only files carrying real EXIF GPS; nothing is guessed from a name or a network.
2. Narrow if needed
   By media kind or date, to the locations that matter to the case.
3. Read the track
   Ordered points become a track where the timestamps allow it.
4. Export for the report
   GeoJSON for a mapping tool, KML for Google Earth.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Bound the timeline to the incident window.22. Narrow to one artefact type, such as evtx or prefetch.33. Rows mentioning a filename, a user or a device.44. Write the l2tcsv every timeline tool reads.

1. 1Start / end bound the timeline to the period in question.
2. 2Kind filter narrow to one artefact type when testing a hypothesis.
3. 3Text filter filter to a filename, a user or a device.
4. 4Export CSV export the log2timeline/Timesketch CSV.

2The options, and when to use them

3Step by step

1. Build the full timeline first
   Point at the artefact files or the folder holding them; establish the sequence before you filter it.
2. Find the window with the histogram
   The event count per bucket shows the shape of activity and the period to zoom into.
3. Bound to the incident window
   Set start and end once the period is known, so the view is readable.
4. Test a hypothesis by kind
   Narrow to execution evidence, or logins, only after the sequence is understood.
5. Export for the report
   Write the l2tcsv every timeline tool reads; remove any row cap before the run that produces the report.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. The memory image to analyse.22. Point at the .raw or .mem file.33. Name the operating system and kernel before running a plugin.44. Run the selected plugin and print its table.

1. 1Image path the captured memory image.
2. 2Browse choose the memory image file.
3. 3Identify the OS identify the OS and the symbols it needs.
4. 4Run run one plugin and read its table.

2The commands, and what each is for

3Step by step

1. See what can run
   List the plugins and whether Volatility 3 is present on this bench.
2. Identify the operating system
   Name the OS and kernel, and the symbols the plugins will need.
3. Run a plugin
   pslist for processes, malfind for injection, netscan for connections - saved so a row can become a finding.
4. Record a row as a finding
   One process or connection, exactly as returned, into the case.
5. Fall back to the in-house reader
   Where Volatility 3 is absent, the in-house scan reads processes without a symbol file.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. The named list you are building.22. Plain words or a /regex/, one per term.33. Saves the named list for reuse across cases.44. Searches the case with the chosen list and prints the hits.

1. 1List name name the keyword list.
2. 2Terms and patterns the words and patterns to search for.
3. 3Create list create and save the named list.
4. 4Run selected run the list against the case.

2The commands, and what each is for

3Step by step

1. Build a named list
   Plain words or a /regex/. A reusable list beats re-typing terms each case.
2. Add or import terms
   Extend it as the case suggests, or import a standard list as plain text.
3. Run it against the case
   Every hit is shown with where it was found.
4. Tag the hits that matter
   A hit becomes case evidence through the case's own door.
5. Export the list for reuse
   Keep the list as plain text so the next case starts from it.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Re-read the installed sets and the case tally.

1. 1Refresh refresh the installed sets and the classify tally.

2The commands, and what each is for

3Step by step

1. Install a hash set
   An NSRL RDS to recognise operating-system and application files, or a known-bad list to flag them.
2. Classify the case
   Every exhibit is labelled known-good, known-bad or unknown in one pass.
3. Read the tally
   The panel shows how many fell into each class.
4. Hide the known-good
   Filter the gallery and lists to the unknowns, so the noise of standard files is gone.
5. Surface the known-bad
   A known-bad match is a lead; open each and corroborate before it becomes a finding.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Bring in a starter set of rules to begin with.22. The name for a rule set you import.33. The .yar / .yara file to import.44. Runs the enabled rules across the case evidence.

1. 1Install starter set install a starter rule set.
2. 2Name name the imported rule set.
3. 3Path the rule file to import.
4. 4Scan the case scan the case with the enabled rules.

2The commands, and what each is for

3Step by step

1. Install or import rules
   A starter set to begin, or your own .yar files by name and path.
2. Enable the ones that apply
   Scope the scan to the rules relevant to this case.
3. Scan the case
   The enabled rules run across the evidence; every hit names its rule.
4. Read and tag the hits
   A hit is a lead; corroborate, then tag the ones that matter.
5. Manage the sets
   Disable or remove rule sets that no longer apply.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. Reads the case's contacts, messages, calls, chats, mailboxes and history into a graph.

1. 1Build / rebuild the graph build the connections graph from the case's own parsers.

2The commands, and what each is for

3Step by step

1. Build the graph
   It reads the case's own parsed data - contacts, messages, calls, chats, mailboxes, history.
2. Read the entities and links
   Nodes and edges with counts and centrality show who and what matter.
3. Ask how two people connect
   The path between two entities, and the ego network around one.
4. Export for a large graph
   Hand it to Gephi or yEd when the graph is too large to read here.
5. Record the connection
   Promote an entity or a link into a case finding.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. A video file or a recorder export to decode.22. Point at the .dav, .h264 or container file.33. The honest reason a given export needs the decode ladder.44. Look the recorder up in the tested registry.

1. 1Source path the recorder export or video to decode.
2. 2Choose file choose the source file.
3. 3Why? read why a decode is needed.
4. 4Make / Model check the recorder against the tested registry.

2The commands, and what each is for

3Step by step

1. State what can be read
   Check the formats this build handles before promising anything to a court.
2. Look the recorder up
   The tested registry says whether the make and model are known.
3. Decode through the ladder
   The ladder tries the container, then the index, then the raw stream, to a folder on another drive.
4. Record the intake
   Copy and hash the export, and type the examiner's name into the case.
5. Keep the recorder's own frames
   Do not re-encode with a converter first; the recorder's frames and its overlay clock are the evidence.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. A decoded asset or a video file to open frame-exact.22. Point at the decoded .mp4 or the video.

1. 1Asset path the decoded footage to review.
2. 2Choose file choose the asset to open.

2The commands, and what each is for

3Step by step

1. Open the asset's timeline
   Frames, keyframes, gaps and the time base - the structure you choose frames from.
2. Bookmark the key frame
   Record the exact ordinal that shows the event, into the case.
3. Build a frame pack
   A range at an interval becomes a small pack - each frame with its ticks, index, overlay clock as text, source hash and its own SHA-256.
4. Verify the pack
   Re-hash every frame and the manifest before it leaves and again on receipt.
5. Keep the three times separate
   The presentation ticks, the overlay clock as text, and the case time are three fields, never merged.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. The asset to redact.22. The rectangle to mask, in pixels.33. From and to frame, for a moving mask.44. The case the redaction and its review are recorded against.

1. 1Asset path the footage or image to redact.
2. 2Region x,y,w,h the region to mask.
3. 3Frame range the frame range to mask across.
4. 4Open or create the case, and the typed examiner.

2The commands, and what each is for

3Step by step

1. Mask the region
   A rectangle in pixels on the frame, recorded against the case. The original is never touched.
2. Track it across the range
   For a moving subject, the mask follows the region from the first frame to the last.
3. Have a named person review
   The decision is typed - who checked, what they decided, and a note - into the case.
4. Export only after approval
   The redacted copy is refused until an approve decision exists.
5. Keep the original untouched
   Redaction produces a copy; the exhibit stays as it was.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. A case asset - a frame pack or an ingested exhibit.22. Pick the asset the lab operates on.33. The explanation of a recipe and the two tracks.

1. 1Asset path the case asset to work on.
2. 2Choose choose the asset.
3. 3What a recipe is read what a recipe is, and the two tracks.

2Two tracks: which to use, and when

3The recipe cards

11. Each classical recipe and what it does, framed as evidentiary or hypothesis.

1. 1Recipe cards the recipe cards and their two-track framing.

4The commands, and what each is for

5Step by step

1. Take frames into the lab
   The lab works on a case asset - a frame pack from review, or an ingested exhibit.
2. Choose the track
   Classical for an evidentiary result another examiner can repeat; the AI track for a labelled hypothesis.
3. Run the recipe
   A deterministic recipe writes an enhanced copy; the chain of operations is printed beneath it.
4. Keep both images
   The enhanced image is shown beside the original, never instead of it, and both are exported.
5. Label a hypothesis as a hypothesis
   An AI-enhanced result is an observation, kept apart from the evidentiary track and never presented as the original.

6Ten situations, and exactly what to do

7The same job at the command line

1How to get there

11. The measurement runs on an ingested case asset, not a loose file path.22. The measurement operation - length, height, speed, pose, distance.

1. 1Case asset the ingested case asset the graph opens on.
2. 2The operation the measurement operation to run.

2The measurements, and what each is for

3Step by step

1. Open the case asset
   The measurement runs on an ingested exhibit, not a loose file path, so the result is anchored to the case.
2. Choose the measurement
   Length, height, speed, camera pose or 3-D distance - the question decides which.
3. Calibrate against a known reference
   A measurement needs a known length or scene geometry in the frame; without it, it is a guess.
4. Read the value with its uncertainty
   The result carries the assumptions and the uncertainty; a single number without them is not a measurement.
5. Record it against the case
   The measurement, the reference and the assumptions go into the case together.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. The image or clip whose authenticity is challenged.22. Point at the exhibit.33. The case the examination is recorded against.44. Optional signed model packs to add to the method set.

1. 1File the file to examine.
2. 2Choose file choose the exhibit.
3. 3Case folder the case to record against.
4. 4Model packs optional signed model packs.

2Methods, and the optional model pack

3The examine wizard and its method cards

11. The queued image for examination.22. Where the ranked method cards are recorded.

1. 1File the queued image.
2. 2Case folder the case the method cards are recorded to.

4The options, and what to set them to

5Step by step

1. Hash and copy the exhibit
   Examine the copy, never the only original.
2. Run every method
   Structure, codec history, double compression, frame statistics and PRNU - reported together, not as one score.
3. Read the method cards
   Each method's result is a card - ELA, noise, PRNU - and the workbench ranks what each supports.
4. Weigh the model pack as an observation
   A model's opinion is labelled and never quoted as the finding; the methods and the examiner make the finding.
5. Record the ranked result
   The methods, the ranking and the examiner's reading go into the case.

6Ten situations, and exactly what to do

7The same job at the command line

1How to get there

11. An image, audio or any file that might carry a concealed payload.22. Runs the examination; reading only, the exhibit is never changed.33. What the examination tests, and what it cannot prove.

1. 1File path the file to examine for hidden data.
2. 2Examine for hidden data run the examination - reading only.
3. 3Methods and limits read the methods and their honest limits.

2The pipeline and the graded verdict

11. The phases the examination runs through to a graded verdict.

1. 1The pipeline the examination phases and the graded verdict.

3The options, and what to set them to

4Step by step

1. Point at the file
   An image larger than its content explains, a file a suspect treated as important, or anything flagged for a second look.
2. Run the examination
   Reading only - the exhibit is never changed - and it prints a graded verdict.
3. Read the grade honestly
   The verdict is graded, and an unconfirmed carve is labelled so it is not mistaken for proven.
4. Extract what is found
   With extraction on, appended data, embedded files and LSB payloads land in a case folder you can open.
5. Record the result
   The verdict and anything carved go into the case, with the honest limits stated.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. The frame-pack .zip - the only unit this door accepts.22. Which finding ids to submit; each leaves the machine if a cloud request proceeds.33. The engine to read with, once the examiner's reading is sealed.44. What to ask, defaulting to reading the plate.

1. 1Frame pack the frame pack to read a plate from.
2. 2Frames to send which frames to submit.
3. 3Provider / model the engine or provider to ask.
4. 4The question the question to put to the engine.

2The engine: which one, and when

3The options, and what to set them to

4Step by step

1. Build the frame pack
   Plate reading takes a frame pack, never a video or a loose picture.
2. Type and seal your own reading
   The examiner's reading is sealed before any engine answer; without it, or --unreadable, there is no route to an answer.
3. Choose the engine
   local or openalpr send nothing and spend nothing; cloud sends the frames and logs each digest.
4. Read the engine's answer as an observation
   The engine read rides behind the sealed reading; the sealed reading is the record.
5. Check against the plate syntax
   India is validated to full depth; another country is reported as observed, not forced into a format it has no pack for.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. The formats this build is proven to read.22. The recorders known to the tool, and what is held but not yet supported.

1. 1Proven coverage the proven-format coverage.
2. 2The registry the recorder registry and the held-but-unsupported list.

2The intake form and its receipt

11. The recorder make, such as Hikvision.22. The recorder model, such as DS-7608.33. Recorder, dashcam, body cam or phone.44. Send a sample so an unsupported format can be added.

1. 1Make the recorder make.
2. 2Model the recorder model.
3. 3Device kind the kind of device.
4. 4Submit sample submit a sample for support.

3The commands, and what each is for

4Step by step

1. Read the proven coverage
   What this build is proven to read, before anything is promised.
2. Look the recorder up
   The registry says whether the make and model are known, and what is held but not yet supported.
3. Record the intake
   The intake form captures make, model, device kind and how it was obtained, and writes a receipt line.
4. Submit a sample for a gap
   Where a format is held but unsupported, a sample lets it be added rather than guessed at.
5. Proceed within the coverage
   Decode and intake only within what is proven; state the limit where it is not.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. Search keyword hits, gallery exhibits and findings.22. The tags and bookmarks recorded across the case.33. Filters saved to return to later.44. The hash-chained record of who did what, when.

1. 1Search search across the case.
2. 2Tags & bookmarks the tags and bookmarks.
3. 3Saved views saved views of the case.
4. 4Audit log the audit log of the case.

2The four tabs, and what each is for

3Step by step

1. Search across the case
   Keyword hits, gallery exhibits and findings in one search, so nothing is siloed by workspace.
2. Gather the tags and bookmarks
   Every mark made in every workspace, in one place.
3. Save a view you will reuse
   A filter stored so the next return to the case starts from it.
4. Read the audit log
   The hash-chained record of who did what, when.
5. Verify the chain before disclosure
   Run audit with the manifest so a trail cut short at the end is caught too.

4Ten situations, and exactly what to do

5The same job at the command line

1How to get there

11. A selector - an email, a number, a hash - to find across cases.22. Finds which cases carry the value.33. A case folder to add to the store.44. Shows what a case shares with others.

1. 1Value to look up the selector to look up.
2. 2Look up look the value up across the store.
3. 3Case folder a case to add to the store.
4. 4Correlate correlate a case with the store.

2A lookup and its result

11. The value being looked up.22. Runs the lookup; the result panel names the cases, or none.

1. 1The selector the selector being looked up.
2. 2Look up the lookup and its result.

3The commands, and what each is for

4Step by step

1. Add cases to the store
   Ingest each case's properties so they can be looked up and correlated.
2. Look a selector up
   An email, a number or a hash returns the cases that carry it.
3. Correlate a case
   See what a new case shares with those already in the store.
4. Read the result honestly
   With one case indexed, a lookup returns no matches; that is the honest answer, not a fault.
5. Move the store if needed
   Export and import to share the store between benches.

5Ten situations, and exactly what to do

6The same job at the command line

1How to get there

11. The case to query; blank uses the most recent.22. A triage question over the case's own indexed data.33. Retrieves the case items that bear on the question.44. Your own reading, sealed before any model answer is disclosed.

1. 1Case folder the case to query.
2. 2The question the triage question to ask.
3. 3Ask run the retrieval.
4. 4Your reading your own reading, sealed first.

2Seal a reading, or seal it inconclusive

3The retrieval and the sealed verdict track

11. The question over the case's indexed data.22. Who is asking; recorded with the sealed reading.

1. 1The question the question asked.
2. 2Examiner the examiner, recorded with the reading.

4The options, and what to set them to

5Step by step

1. Ask the question
   Retrieval returns the case items that bear on it, from the case's own indexed data - nothing outside it.
2. Read the retrieved items
   The items are the evidence; the question is answered from them.
3. Seal your own reading
   Type your reading, or seal it inconclusive, before any model answer - it is sealed once, and a later change is an edit.
4. Reveal the model's words
   The reveal is an audited event, recorded with who did it and when.
5. Keep the model an observation
   The model's text is an observation, never a finding; revealing it records that it was seen.

6Ten situations, and exactly what to do

7The same job at the command line

1How to get there

11. The asset or pack to export from.22. The frame range for the export.33. The case the export and certificate are recorded against.44. The examiner, typed, on the certificate.

1. 1Asset path the asset to export.
2. 2From / to the range to export.
3. 3Case name the case for the export.
4. 4Examiner the typed examiner.

2The certificate builder

11. The case the certificate is drawn from.22. The examiner named on the S.63(4) certificate.

1. 1Case name the case for the certificate.
2. 2Examiner the examiner on the certificate.

3The commands, and what each is for

4Step by step

1. Verify the pack
   Re-hash every frame and the manifest so what leaves is proven unchanged.
2. Open the certificate builder
   It draws from what the case actually holds, with the case and the examiner named.
3. Draft the certificate
   The S.63(4) BSA-2023 certificate and the CASE-UCO export, generated from the case.
4. Name the examiner
   The certificate is signed by a named examiner, typed, not inferred.
5. Keep the export with the case
   The certificate, the CASE-UCO export and the verified pack travel together.

5Ten situations, and exactly what to do

6The same job at the command line