Lose a machine on purpose and recover the person, not just the computer

capstone · 120 min · Objective 4.3

Task

Run the whole thing end to end: declare a machine lost, get the user working within the hour by some other means, recover properly, and produce the record. This is the course's final capstone because it uses every domain -- the operating system, the security position, the troubleshooting judgement and all of this domain's documentation -- and because the measure of success is a person working rather than a machine running.

Steps

  1. Declare the loss: write lab/capstone/loss.md stating what happened, what the machine held, what was encrypted, and what the user needs to do today.
  2. Get the user working within an hour by some other route, and record it in lab/capstone/interim.csv with header option,minutes_to_arrange,what_it_enables,what_it_does_not.
  3. Recover properly, keeping a contemporaneous log in lab/capstone/log.csv with header time,stage,action,result,blocked_by.
  4. Verify against your own definition of working, recording each check in lab/capstone/verify.csv with header requirement,check,result,pass.
  5. Write lab/capstone/report.md as the closing record: what was lost, what was recovered, what was not recoverable and why, what the recovery actually cost in time, and the two things that would have made it faster -- each of which should be something created on an ordinary day rather than during the incident.

Verify

grep -Eic 'encrypt|held|needs' lab/capstone/loss.md
awk -F, 'NR>1 && NF>=4 {n++} END {print n" interim option(s)"}' lab/capstone/interim.csv
awk -F, 'NR>1 && $2+0 <= 60 {n++} END {print n" option(s) arrangeable within the hour"}' lab/capstone/interim.csv
awk -F, 'NR>1 && NF>=5 {n++} END {print n" logged stage(s)"}' lab/capstone/log.csv
awk -F, 'NR>1 && $4 ~ /no|fail/ {n++} END {print n" verification(s) that failed"}' lab/capstone/verify.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" verification(s) run"}' lab/capstone/verify.csv
grep -Eic 'not recoverable|could not|lost' lab/capstone/report.md
grep -Eic 'ordinary day|beforehand|before the|in advance' lab/capstone/report.md

At least one interim option arrangeable within the hour, eight or more logged stages, every requirement verified, and a report naming both what was not recoverable and two things that would have had to exist beforehand. A report with nothing unrecoverable and nothing to improve is a report about an exercise rather than a recovery.

Notes

The last clause is the whole course in one sentence. Almost every fault on this exam is reversible; what makes any of them irreversible is the absence of a copy of the data and a record of what the machine was -- and both are made on ordinary days by someone who has no idea which machine will need them.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.