Casework
Running an investigation: scope, hypotheses, preservation, attribution, findings.
Tier 1
The Case Question
A case without a written question has no stop condition.
Write the question in one sentence, name the decision it serves, list the evidence that would settle it either way, and set the condition under which you stop. Scope creep is the absence of a question, not thoroughness.
Tier 1
Preserve Before Analysis
Material disappears exactly when it matters.
Capture to an independent archive and locally, hash each file at capture, and log the source, time, tool, and handler contemporaneously. Analyze the copy, never the original.
Tier 2
Competing Hypotheses
A favored explanation will select its own evidence.
Generate every explanation before testing any, including the benign one and deliberate deception. Score each item for inconsistency, strike what fits everything, and keep the hypothesis with the least against it.
Tier 2
Defensible Timelines
Time zones and clock drift invent sequences that never happened.
Normalize to UTC, record each source's measured offset, corroborate critical events across independent sources, draw gaps as gaps, and keep causation in a separate column from sequence.
Tier 3
Attribution Discipline
The cheapest indicators are the ones left for you to find.
Separate machine, operator, and sponsor. Rank indicators by the cost of faking them: hashes and addresses are trivial, tradecraft is expensive. State likelihood and confidence apart, and write the scenario in which you are wrong.
Tier 3
Harm and the Legal Edge
An investigation can do more damage than what it investigated.
Name everyone the finding touches and ask what happens if you are wrong. Minimize identifying data, check that the access was lawful, check the recording rule for every participant's jurisdiction, and offer a right of reply.