C2 FORENSIC
Reconstructing Accounts
ការរៀបចំសាច់រឿងឡើងវិញ
🕵️ Case 404: The Server Breach
Subject: Mr. Vance (IT Head). He is explaining why the server crashed. Listen for timeline jumps and contradictions.
Subject: Mr. Vance (IT Head). He is explaining why the server crashed. Listen for timeline jumps and contradictions.
1. "Look, I wasn't even in the office when the alert triggered. I was at lunch... around 1:00 PM."
2. "But before that... wait, no. After lunch, I checked the logs. Everything was green."
3. "The crash happened because... well, Sarah sent that phishing email at 2:30 PM. That's when I got the alert."
⚠️ HARD EVIDENCE (DO NOT IGNORE)
- 12:45 PM: Server Access Card swipe (Vance)
- 1:15 PM: System Critical Alert recorded
- 2:30 PM: Phishing Email Received
Reconstruct the ACTUAL sequence based on Evidence vs. Testimony:
Drag events mentally and click the correct order below.
A
Vance Accesses Server Room (12:45)B
System Alert Triggers (1:15)C
Phishing Email Sent (2:30)Which sequence is correct?
Verify Vance's statements against the Evidence Log:
Claim: "I was at lunch at 1:00 PM."
Claim: "The alert happened at 2:30 PM."
Claim: "Phishing caused the crash."
Select True/False based on the Evidence Box.
Task: Write the Incident Summary.
Synthesize the contradictions. Why is Vance lying? Use terms: "Discrepancy", "Timeline", "Alibi".