Produce a custody record for a stated scenario, with no gap in the timeline

applied · 45 min · Objective 4.1

Task

Write the custody record and the incident account for a scenario you construct. This is the applied lab for the objective because every hands-on version would involve handling regulated data or prohibited content, and the first rule of the objective is to stop rather than investigate -- so the artefact is the exercise.

Steps

  1. Write lab/custody/scenario.md describing an invented situation: what you were asked to do, what you found, and the moment the job changed from a repair into something else.
  2. Write lab/custody/record.csv with header datetime,event,item_identifier,person,location,signature covering discovery, securing, storage, and at least one handover -- with no gap in the timeline.
  3. Write lab/custody/account.md as your written account: what you observed, when, what you did and what you did not do. Facts only, no conclusions about who or why.
  4. Write lab/custody/classes.csv with header data_class,example_on_this_machine,obligation covering at least five regulated data classes.
  5. Write lab/custody/stop.md listing what you did NOT do and why -- not opening files, not copying, not deleting, not powering the machine on or off, not telling colleagues.

Verify

awk -F, 'NR>1 && NF>=6 {n++} END {print n" custody event(s)"}' lab/custody/record.csv
awk -F, 'NR>1 {print $1}' lab/custody/record.csv | sort | head -1
awk -F, 'NR>1 && $6=="" {n++} END {print n" event(s) with no signature"}' lab/custody/record.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" data class(es)"}' lab/custody/classes.csv
grep -Ec '^[-*0-9]' lab/custody/stop.md
grep -Eic 'did not open|did not copy|did not delete|did not power' lab/custody/stop.md

Four or more custody events with no unsigned row, five data classes, and a stop list naming at least one thing deliberately not done. An unsigned event is a gap, and a gap at the beginning cannot be filled in afterwards.

Notes

The record begins with the person who finds the item, which on a support desk is frequently you. It is not started later by an investigator, and that is the part people get wrong.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.