HARBOR-17 / 06 / PRACTICE GUIDE

Digital evidence, hashes and timelines

Separate byte integrity from source truth. Preserve original timestamps, produce a UTC view and trace evidence handling and purpose.

Download guide and workpapers

Original AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.

Evidence and timeline desk

Use synthetic normalized records only. Entered text is neither transmitted nor saved to an account; include no real secrets or personal data. This tool does not parse raw email, EVTX or PCAP.

Synthetic case JSON

{
  "caseId": "harbor-17",
  "artifacts": [
    {
      "id": "mail-export",
      "label": "Fictional mail-export",
      "sha256": "323f368733d8cf58330cd2e3a3395538aea4104f98e1e96876c5a89921c11eae"
    },
    {
      "id": "endpoint-export",
      "label": "Fictional endpoint-export",
      "sha256": "4d6e0d5c695a119841f043e870f266d1065a3143cc77cf2a269718425f5c5b74"
    }
  ],
  "events": [
    {
      "id": "e-04",
      "time": "2026-10-21T06:06:00Z",
      "source": "endpoint",
      "action": "executed",
      "detail": "Synthetic process event; process name alone does not establish maliciousness.",
      "user": "ada",
      "host": "nb-17",
      "artifact": "endpoint-export"
    },
    {
      "id": "e-01",
      "time": "2026-10-21T09:00:00+03:00",
      "source": "mail",
      "action": "received",
      "detail": "Fictional helpdesk message; trusted receiver headers not yet supplied.",
      "user": "ada",
      "artifact": "mail-export"
    },
    {
      "id": "e-03",
      "time": "2026-10-21T08:05:00+02:00",
      "source": "identity",
      "action": "signed-in",
      "detail": "Successful sign-in; session ownership and device context remain unverified.",
      "user": "ada",
      "ip": "203.0.113.20"
    },
    {
      "id": "e-02",
      "time": "2026-10-21T06:03:00Z",
      "source": "mail",
      "action": "clicked",
      "detail": "Supplied record reports a link click; no destination is contacted.",
      "user": "ada",
      "host": "nb-17"
    },
    {
      "id": "e-05",
      "time": "2026-10-21T06:06:00Z",
      "source": "network",
      "action": "connected",
      "detail": "Connection near the process event; byte direction and process linkage missing.",
      "host": "nb-17",
      "ip": "198.51.100.25"
    },
    {
      "id": "e-06",
      "time": "2026-10-21T06:10:00Z",
      "source": "analyst",
      "action": "reported",
      "detail": "Fictional user report; no real message is sent.",
      "user": "ada"
    }
  ]
}

Ties retain input order, not proven real-world sequence or clock accuracy. Artifact hashes here are metadata; actual byte checks are demonstrated in the downloaded verify-fixtures exercise.

EVIDENCE REVIEW DESK

Move from observations to decisions.

Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.

Hash matched / Incomplete decision

Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.

s=>s.hashMatches

Hash matching supports byte integrity, not source truth or admissibility. Origin, acquisition and custody records are separate requirements.

Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.

01 / EXPLANATION

What does a hash establish?

A matching SHA256 helps compare byte integrity; it cannot by itself establish truthful contents, authorized acquisition or legal admissibility. Record acquisition method, origin, time, tool version and handler separately. Preserve originals and work from copies; do not present transformed CSV/report bytes under the original hash. Actual evidence requires the organization’s authorized procedures and applicable requirements.

02 / EXPLANATION

Normalize clocks, retain uncertainty

Preserve the original timestamp/offset and store UTC as a separate view. Do not assume UTC for missing offsets. This narrow teaching profile rejects -00:00; Z expresses UTC, not proof of clock accuracy or the source’s local offset. This tool accepts a restricted RFC3339 form with seconds and up to milliseconds and rejects leap seconds. Impossible dates and duplicate event IDs produce errors. It does not measure clock skew; the analyst must record that uncertainty separately.

03 / EXPLANATION

Custody and transfer chain

Trace who acquired/transferred material, when, for what purpose and with which integrity checks. Uploading to a shared folder does not automatically create custody history. Bind access and retention decisions to purpose and organizational legal/contractual requirements through authorized teams. NISTIR8387 focuses on preservation;800-86 is an older foundational IT-forensics reference, not a current tool manual or legal advice.

04 / EXPLANATION

Harbor-17 actual hashes and normalization

verify-fixtures hashes actual bytes of two fixed-name synthetic texts and compares case metadata; labels never become arbitrary local paths. The browser shows hash metadata without verifying file bytes. Raw EML, EVTX and PCAP are not parsed. The timeline CLI reads only the explicitly named normalized JSON and additionally hashes that input. Sorting and a two-minute correlation are not breach decisions; missing session, clock and user evidence remains visible.

Build the evidence yourself.

Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.

Case scope and collection authorityMarkdown · EN Hypothesis and evidence collection planMarkdown · EN Observation, hypothesis and gap recordMarkdown · EN Response and closure decisionMarkdown · EN

Full guide with code, outputs and reasoning ↓

Primary references

Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.