Pocket CTF Reference · Device home

Working Notes

Three ordinary text files are being considered for a publication package. Determine which retained details are unnecessary and could identify a source when combined.

Objective

By completing this module, you will be able to:

Before you begin

Download all three station files. Open them side by side and make a table with columns for names, places, dates, contact details, and reporting purpose.

Concepts

A direct identifier names a person outright. A quasi-identifier may appear harmless alone but narrow identity when combined with a place, date, role, or travel record. Data minimization asks whether each precise detail is necessary for the intended publication.

Three preserved artifacts feed a comparison of identifiers, times, and provenance. Observations are separated from inference, with uncertainty carried into the finding.

Preserve each artifact and record its source before comparing identifiers, timestamps, and provenance. A repeated value can link records, but shared origin or copied data may make evidence dependent. Separate observed facts from inferred relationships, note conflicting explanations, and state the limits of the resulting finding. Correlation alone does not prove causation.

Suggested tools

Tool practice

Rehearse the worked tool exercise before using challenge data.

Use editor Find or rg -n -F for exact repeated text across your downloaded files. Record filename and line beside each match. Start with a literal identifier from the evidence; broad word searches help discovery but do not prove two records refer to the same person.

Investigation

Observe

List details repeated across the biography, interview preparation, and expense record. Separate facts needed to support the story from details needed only for internal reporting operations.

Form a hypothesis

Which value directly identifies the source? Which destination and exact date make the meeting easier to reconstruct than the published story requires?

Test carefully

Submit one unnecessary identifying value at a time. Prefer the most direct identifier first, then test the place and precise date that strengthen the linkage.

Progressive hints

Hint 1

Start with the interview-preparation heading and the expense purpose.

Hint 2

Compare the travel destination and meeting location across the files.

Hint 3

The station accepts a source name, a destination city, and an ISO-formatted travel date as separate findings.

Troubleshooting and reset

Make sure you downloaded and reviewed all three files. Submit the date in the same numeric format used by the evidence. If the audit has been closed, begin a fresh browser session before attempting additional findings.