Open case file · Code-gated questions

Operation Silent Trace enters the analysis room.

Build an evidence-led timeline from verified computer, phone, network and removable-media artefacts while separating technical association from human attribution.

20Questions

25:00Time

CodeRequired

Case file · Read before answering

Operation Silent Trace: the analysis room

At 10:15, the Operation Silent Trace analysis team receives verified working copies and the Day 2 acquisition records. Authority remains limited to evidence relevant to redirected parcel collections between 18 and 20 September. The team must build a defensible timeline from computer, phone, network and removable-media artefacts without confusing technical association with proof of identity or intent.

Analysis briefing

Laptop working copy

The laptop was configured for Central Africa Time (UTC+02:00); its last recorded successful time synchronisation was 07:10 UTC.
Browser history records a visit to dispatch-update.example/change at 13:38 CAT. redirect-list.csv was modified at 13:42 CAT under the shared local account courier.shared.

Phone extraction

The extraction reports timestamps in UTC and contains a message received at 11:40 UTC: “Collection changed to 14:30”.
The extraction associates the message with the handset, but the current material does not establish who held or operated the phone at that moment.

Network records

A DHCP record associates the phone’s recorded MAC address with 10.20.0.44 from 11:30 to 12:05 UTC.
A DNS log records a lookup for dispatch-update.example from 10.20.0.44 at 11:37 UTC. The DNS record contains no page content, message content or user identity.

USB and contextual records

The USB working copy contains redirect-list.csv with a 13:44 CAT modified time, but its SHA-256 differs from the laptop file.
The staff rota places three employees in the office during the relevant period. The courier.shared password was known to more than one employee. CCTV is available, but its clock offset has not yet been measured.

Your mission

Normalise time carefully, test the reliability and meaning of each artefact, correlate independent sources, record searches and tools, consider alternative explanations, and report only conclusions supported by the evidence and its known limitations.

Day 3 analysis rules

1Analyse verified working copies and record the tool, version, query, filter and time of each material step.
2Retain original timestamps and time-zone context, then normalise a separate timeline consistently.
3Correlate independent sources and explain what each artefact can and cannot establish.
4Treat accounts, IP addresses, device identifiers and filenames as associations—not automatic proof of a person or intent.
5Record negative results, conflicting artefacts, incomplete data and reasonable alternative explanations.
6Stay within authorised scope and separate observations, interpretations and conclusions in the report.

Working evidence register

Exhibit	Item	Observed state
AN-001	Laptop working copy	Verified copy; CAT/UTC+02:00 source timestamps retained
AN-002	Phone extraction	Verified extraction; timestamps reported in UTC
AN-003	Router and DHCP records	Preserved exports; network association only
AN-004	USB working copy	Verified copy; same filename but different file hash
AN-005	Staff rota	Three employees recorded on site; requires corroboration
AN-006	CCTV export	Available; clock offset not yet validated

Day 3 reference

Timeline discipline

Preserve each source timestamp and zone, document conversion assumptions, normalise to one comparison standard such as UTC, and flag clocks whose offset or drift is unknown.

Correlation and attribution

Several independent artefacts can strengthen a sequence, but a device, account or address association does not by itself identify the human actor or prove intent.

Reproducible analysis

Record sources, tools, versions, searches, filters, results and limitations so another competent analyst can understand and test the reasoning.

Normalise carefully

Retain source timestamps and zones before comparing events on one documented timeline.

Corroborate

Use independent artefacts together while preserving what each source cannot prove.

Report proportionately

Separate observation, interpretation and conclusion, including conflicts and limitations.

Training boundary

This is an original fictional MUST case. Real analysis requires lawful authority, approved Malawi Police Service procedure, validated tools, competent personnel and independent review appropriate to the case.