1. Hash Verifier
Baseline hashes for server_access.log — recorded 2026-07-25T10:18:12
| file | \forensics-toolkit\evidence_sample\server_access.log |
| size_bytes | 514 |
| md5 | 4006186ba659efa2c721ed97d0103318 |
| sha256 | e4d626c55219cde83a062acee15e75976209c0972bb82f1602181daa6fb52c2b |
2. Hash Verifier
Chain-of-custody re-verification — recorded 2026-07-25T10:18:12
| file | \forensics-toolkit\evidence_sample\server_access.log |
| algorithm | SHA256 |
| known_hash | e4d626c55219cde83a062acee15e75976209c0972bb82f1602181daa6fb52c2b |
| computed_hash | e4d626c55219cde83a062acee15e75976209c0972bb82f1602181daa6fb52c2b |
| match | True |
INTEGRITY VERIFIED - file unchanged
3. Timeline Generator
Timeline of 7 files — recorded 2026-07-25T10:18:12
| file | size_bytes | created | metadata_changed | modified | accessed |
|---|
| witness_statement.txt | 474 | None | 2026-07-25 10:16:12 | 2026-07-25 10:16:12 | 2026-07-25 10:16:43 |
| server_access.log | 514 | None | 2026-07-25 10:16:12 | 2026-07-25 10:16:12 | 2026-07-25 10:16:43 |
| internal_memo.txt | 431 | None | 2026-07-25 10:16:12 | 2026-07-25 10:16:12 | 2026-07-25 10:16:43 |
| cctv_frame_2340.jpg | 17174 | None | 2026-07-25 10:16:25 | 2026-07-25 10:16:25 | 2026-07-25 10:16:32 |
| incident_report_draft.pdf | 1528 | None | 2026-07-25 10:16:25 | 2026-07-25 10:16:25 | 2026-07-25 10:16:32 |
| hidden_notes.txt | 17174 | None | 2026-07-25 10:16:32 | 2026-07-25 10:16:32 | 2026-07-25 10:16:43 |
| disk_image_unallocated.bin | 7748 | None | 2026-07-25 10:16:32 | 2026-07-25 10:16:32 | 2026-07-25 10:16:43 |
4. Metadata Extractor
Batch metadata for 7 files — recorded 2026-07-25T10:18:12
\forensics-toolkit\evidence_sample\internal_memo.txt
| file | \forensics-toolkit\evidence_sample\internal_memo.txt |
| extension | .txt |
| size_bytes | 431 |
| modified | 2026-07-25 10:16:12 |
| accessed | 2026-07-25 10:16:43 |
| line_count | 8 |
| word_count | 60 |
| char_count | 431 |
\forensics-toolkit\evidence_sample\cctv_frame_2340.jpg
| file | \forensics-toolkit\evidence_sample\cctv_frame_2340.jpg |
| extension | .jpg |
| size_bytes | 17174 |
| modified | 2026-07-25 10:16:25 |
| accessed | 2026-07-25 10:16:32 |
| dimensions | 320x240 |
| format | JPEG |
| mode | RGB |
| exif | No EXIF data present |
\forensics-toolkit\evidence_sample\witness_statement.txt
| file | \forensics-toolkit\evidence_sample\witness_statement.txt |
| extension | .txt |
| size_bytes | 474 |
| modified | 2026-07-25 10:16:12 |
| accessed | 2026-07-25 10:16:43 |
| line_count | 11 |
| word_count | 86 |
| char_count | 474 |
\forensics-toolkit\evidence_sample\disk_image_unallocated.bin
| file | \forensics-toolkit\evidence_sample\disk_image_unallocated.bin |
| extension | .bin |
| size_bytes | 7748 |
| modified | 2026-07-25 10:16:32 |
| accessed | 2026-07-25 10:16:43 |
| note | No type-specific extractor for this file type |
\forensics-toolkit\evidence_sample\hidden_notes.txt
| file | \forensics-toolkit\evidence_sample\hidden_notes.txt |
| extension | .txt |
| size_bytes | 17174 |
| modified | 2026-07-25 10:16:32 |
| accessed | 2026-07-25 10:16:43 |
| line_count | 109 |
| word_count | 818 |
| char_count | 16316 |
\forensics-toolkit\evidence_sample\incident_report_draft.pdf
| file | \forensics-toolkit\evidence_sample\incident_report_draft.pdf |
| extension | .pdf |
| size_bytes | 1528 |
| modified | 2026-07-25 10:16:25 |
| accessed | 2026-07-25 10:16:32 |
| page_count | 1 |
| title | Incident Report Draft |
| author | J. Marsh |
| producer | ReportLab PDF Library - (opensource) |
| creation_date | D:20260725101625+00'00' |
\forensics-toolkit\evidence_sample\server_access.log
| file | \forensics-toolkit\evidence_sample\server_access.log |
| extension | .log |
| size_bytes | 514 |
| modified | 2026-07-25 10:16:12 |
| accessed | 2026-07-25 10:16:43 |
| line_count | 6 |
| word_count | 60 |
| char_count | 514 |
5. Keyword Searcher
10 keyword matches — recorded 2026-07-25T10:18:12
Files scanned: 3 | Files skipped: 4 | Total matches: 10
| file | line_number | line_text | keyword |
|---|
| internal_memo.txt | 5 | against the admin panel from internal IP 192.168.1.14, followed by a | 192.168.1.14 |
| internal_memo.txt | 8 | and password reset for the admin account. Suspected credential: falcon2024 | falcon2024 |
| witness_statement.txt | 7 | the plate but I believe it started with LK19. | LK19 |
| witness_statement.txt | 9 | The password mentioned on the phone call sounded like "falcon2024" but | falcon2024 |
| server_access.log | 1 | 192.168.1.14 - - [14/Oct/2026:23:31:02 +0100] "GET /admin/login HTTP/1.1" 200 512 | 192.168.1.14 |
| server_access.log | 2 | 192.168.1.14 - - [14/Oct/2026:23:31:47 +0100] "POST /admin/login HTTP/1.1" 401 128 | 192.168.1.14 |
| server_access.log | 3 | 192.168.1.14 - - [14/Oct/2026:23:32:03 +0100] "POST /admin/login HTTP/1.1" 401 128 | 192.168.1.14 |
| server_access.log | 4 | 192.168.1.14 - - [14/Oct/2026:23:32:19 +0100] "POST /admin/login HTTP/1.1" 200 890 | 192.168.1.14 |
| server_access.log | 5 | 192.168.1.14 - - [14/Oct/2026:23:33:01 +0100] "GET /admin/export?table=customers HTTP/1.1" 200 40213 | 192.168.1.14 |
| server_access.log | 6 | 192.168.1.14 - - [14/Oct/2026:23:41:55 +0100] "GET /admin/logout HTTP/1.1" 200 64 | 192.168.1.14 |
6. Deleted File Finder
3 signatures carved — recorded 2026-07-25T10:18:12
Scanned \forensics-toolkit\evidence_sample\disk_image_unallocated.bin (7748 bytes) | Signatures found: 3
| offset_hex | offset_decimal | signature_type | likely_extension | signature_hex |
|---|
| 0x1f4 | 500 | JPEG | .jpg | FFD8FF |
| 0x10cc | 4300 | PDF | .pdf | 25504446 |
| 0x1b80 | 7040 | PNG | .png | 89504E470D0A1A0A |
7. Deleted File Finder
1 mismatches found — recorded 2026-07-25T10:18:12
Folder: \forensics-toolkit\evidence_sample | Mismatches found: 1
| file | claimed_extension | detected_type | expected_extension | flag |
|---|
| hidden_notes.txt | .txt | JPEG | .jpg | MISMATCH - possible disguised or renamed file |