Open interactive activity · Day 1

Operation Silent Trace starts at the scene.

Read one complete courier-office case, then apply the Day 1 evidence-identification, preservation and documentation principles to twenty questions.

20Questions

25:00Time

OpenNo sign-in

Case file · Read before answering

Operation Silent Trace: the courier office

At 09:40, two officers secure a small courier office after a report that digital communications may have been used to redirect parcel collections. No device has been examined since the officers entered. You are part of the first-response team; the digital-forensics specialists are on their way.

Observed scene

North desk

A closed silver laptop is powered off. Its charger is plugged into the wall but not into the laptop.
A black Android phone lies face-up and unlocked. Its screen shows a messaging notification preview reading “Collection changed to 14:30”. Wi-Fi and mobile-data icons are visible, notifications continue to arrive, and a charging cable is connected.
A blue USB flash drive labelled “BACKUP” lies beside the laptop.

Network shelf

A router/modem is powered on with indicator lights visible and two Ethernet cables connected.

Chair and open drawer

A loose microSD card is on the floor near the office chair.
An A5 notebook contains email addresses, account aliases and several password-like strings.

Service counter

A printed parcel receipt shows a tracking number and a collection time.
Two spare charging cables and a memory-card adapter are in a tray.

Your mission

Identify, document and preserve potential evidence. Do not search, unlock, browse or analyse any device. Record only what you can observe and escalate preservation decisions through the approved procedure.

Day 1 operating rules

1Use the STOP approach: Stop, Think, Observe, Preserve and Document.
2Take wide, medium and close-up photographs before handling an item.
3Record location, condition, power and screen state, connected cables and visible serial or IMEI details.
4Do not browse, unlock, search, open files or casually change a device or network state.
5Note immediate risks, including remote wipe, then follow approved preservation and escalation procedures.
6Write what you observed; do not turn an assumption into a fact.

Initial exhibit register

Exhibit	Item	Observed state
MUST-DF-001	Silver laptop	Closed and powered off
MUST-DF-002	Black Android phone	Powered on, unlocked and network-connected
MUST-DF-003	Blue USB flash drive	Not connected
MUST-DF-004	MicroSD card	Loose on floor near chair
MUST-DF-005	Router/modem	Powered on with two cables connected
MUST-DF-006	A5 notebook	Found in open drawer

Day 1 reference

Practical forensic flow

Identify potential digital evidence, preserve the original state, acquire data safely and repeatably, analyse artefacts with approved tools, then document and present findings clearly.

Evidence-source value

Phones can support communication and timeline evidence; computers and storage media may support activity and file evidence; routers may add network context; email, social-media and cloud accounts may add communication and public-facing content.

Required Day 1 outputs

Prepare an evidence-identification checklist, clear scene notes, an exhibit list, photograph or screenshot references, and debrief points explaining what could be missed and why it matters.

Use the facts

Every case-specific answer is supported by the briefing, observations or exhibit register.

Apply Day 1

Use STOP, preserve-before-analysis and accurate scene-documentation principles.

Debrief

Submission reveals the best answer and a practical explanation for every question.

Training boundary

This fictional scenario reinforces classroom principles. Officers must still follow Malawi Police Service authority, evidence-handling procedures and specialist direction in real investigations.