Open case file · Facilitator-gated questions

Operation Silent Trace reaches the acquisition desk.

Continue the fictional investigation by checking authority, custody, source protection, acquisition records, cryptographic verification and the handover to analysis.

20Questions

25:00Time

CodeRequired

Case file · Read before answering

Operation Silent Trace: the acquisition desk

At 08:30 the next morning, the sealed Operation Silent Trace exhibits arrive at the digital-forensics workspace. The scene team has preserved the observed states from Day 1. Written authority permits examination of evidence relevant to redirected parcel collections between 18 and 20 September, but it does not authorise investigators to reuse recorded passwords or sign in to cloud accounts. Your team must decide whether each item is ready for controlled acquisition before any analysis begins.

Acquisition intake

Evidence intake

The seals on MUST-DF-001, MUST-DF-002 and MUST-DF-003 match the Day 1 register and show no visible damage.
MUST-DF-004 is sealed and its identifiers match, but the custody form has no transfer time for the move from the scene store to the laboratory.

Acquisition workstation

A clean forensic workstation has approved imaging software, a tested hardware write blocker and destination media with sufficient free space.
The workstation clock is synchronised to the approved time source. Tool name, version, operator and start/end times must be recorded.

Mobile-device bench

MUST-DF-002 remains powered on and radio-isolated in its sealed enclosure. Its displayed battery level is 62 percent.
The mobile-device specialist is available. Guessing a passcode, browsing the handset or casually changing its state is not authorised.

Network evidence desk

The network administrator supplied router-export.json with source device, export time and export method recorded.
No source-side hash was recorded before transfer. The received file is preserved, but this limitation still needs to be documented.

Your mission

Check authority, custody, seals, equipment and records; choose the least-changing approved acquisition route; verify acquired data; preserve originals; and prepare a defensible handover for analysis. Stop and escalate any gap that cannot be honestly resolved.

Day 2 acquisition rules

1Confirm legal authority, scope, identifiers, seals and custody before acquisition.
2Protect originals from avoidable change; use an approved write blocker where the source supports it.
3Record operator, tool and version, source and destination, method, times, errors and deviations.
4Use cryptographic hashes to verify data integrity between recorded states; a matching hash does not prove authorship or truth.
5Analyse a verified working copy and keep the preserved original or master image protected.
6Minimise unrelated personal data and stop when authority, custody or technical capability is unclear.

Acquisition register

Exhibit	Item	Observed state
MUST-DF-001	Silver laptop	Seal intact; powered off; approved for write-blocked imaging
MUST-DF-002	Black Android phone	Seal intact; powered on; radio-isolated; specialist route required
MUST-DF-003	Blue USB flash drive	Seal intact; approved for write-blocked imaging
MUST-DF-004	MicroSD card	Seal intact; custody transfer time missing
MUST-DF-005	Router export	Received as router-export.json; source-side hash unavailable
MUST-DF-006	A5 notebook	Seal intact; contextual item; recorded passwords are outside current login authority

Day 2 reference

Acquisition record

Tie the source identifier to the destination image, operator, approved method, tool version, start/end times, hash values, errors and any departure from procedure.

Integrity and working copies

A matching cryptographic hash supports that two recorded byte streams match. Protect the master image and conduct examination on a separately verified working copy.

Scope and candour

Collect only within authority, minimise unrelated data, preserve failed or partial outcomes according to procedure, and document limitations instead of concealing them.

Check readiness

Confirm authority, custody, seals, identifiers and equipment before changing state.

Acquire and verify

Protect sources, record the method and use hashes for the integrity claim they actually support.

Handover honestly

Give analysts verified copies, complete records, scope and known limitations.

Training boundary

This is an original fictional MUST case. Real acquisition requires lawful authority, approved Malawi Police Service procedure, validated tools, competent personnel and case-specific specialist direction.