Capstone: Investigate the Incident
Analyze the supplied synthetic incident without altering the source evidence.
Analyze the supplied synthetic incident without altering the source evidence.
Prepare 30m · Build 150m · Verify 40m · Document 20m
Work only inside the folder created by Smartphone-Academy.py prepare capstone-incident. Use the supplied samples or systems you personally administer.
Prepare the Termux workspace
Open Termux in the Academy root and prepare this lab with the local companion. It creates safe samples, notes and evidence files under your Termux account.
python Smartphone-Academy.py prepare capstone-incidentNo root. Use the supplied files and keep the workspace under $HOME.Practical mission
- Verify every evidence file before analysis
- Correlate authentication, network and file-change records
- Test at least two competing explanations
- Recommend proportionate containment while preserving evidence
An investigation package with timeline, findings, confidence and containment advice.
Quality gate
Analyst reflection
Which result from “Recommend proportionate containment while preserving evidence” would need more evidence before it could support an operational decision?
After checking the evidence, run python Smartphone-Academy.py complete capstone-incident. Progress is stored locally in the Termux home directory.