Capstone: Build a Mobile Incident Response Casefile
Combine file integrity, package, network, log, and configuration evidence from a supplied fictional Android and Termux incident into one defensible casefile.
Combine file integrity, package, network, log, and configuration evidence from a supplied fictional Android and Termux incident into one defensible casefile.
Prepare 45m · Build 225m · Verify 45m · Document 45m
Work only inside the folder created by Smartphone-Academy.py prepare mobile-response-casefile. Use the supplied fictional samples or data you are explicitly authorized to handle.
Prepare the Termux workspace
Open Termux in the Academy folder and create the safe workspace. The companion generates samples, notes, and evidence files under your account.
python Smartphone-Academy.py prepare mobile-response-casefileNo root. Work only with the supplied files under $HOME.Practical mission
- Establish scope, evidence identifiers, and hashes before analyzing the supplied incident files
- Correlate package, file, network, configuration, and log events into a single timeline
- Separate verified facts, supported inferences, unresolved questions, and rejected hypotheses
- Produce a concise executive summary plus technical appendices that another learner can reproduce
A complete casefile folder containing scope.md, evidence-register.csv, timeline.csv, findings.md, limitations.md, and an executive-summary.md.
Quality gate
Analyst reflection
Which result from “Produce a concise executive summary plus technical appendices that another learner can reproduce” needs additional evidence before it could support a real operational decision?
After checking the deliverables, run python Smartphone-Academy.py complete mobile-response-casefile. Progress is stored locally in the Termux home directory.