This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
The Note That Isn't There
Pull a removed handover detail back out of repository history instead of searching only the current files.
Synthetic training evidence that stays internally consistent. Check the repository history, the timestamps, the hashes and the agreement between sources. Never extend the scenario to real people or infrastructure.
01Incident summary
A responder tidied up a temporary field note before the review team arrived. The current directory shows that something was removed, but not what it said. The clue is still sitting in ordinary Git history. You don't need brute force, a hidden API or a platform bug. The one thing you have to notice is that the working tree is only a single state of the evidence.
02Analyst mission
Find the commit that deleted the note. Recover the earlier version of the handover note. Read the procedure phrase without treating it as a credential.
03Review the evidence
Evidence route
Open the public repository and preserve these records before you draw a conclusion.
| Indicator Type | Evidence path | Analytical Context |
|---|---|---|
| Current field-notes directory | field-notes/README.md | Confirm that cleanup happened before anything was preserved. |
| Repository history | git log --all --diff-filter=D --summary | Find the deletion and look at the tree just before it. |
This table shows file paths and Git refs in the public evidence repository. None is a live scanning target.
04Tasks
4 steps- 01
Find the commit that removed the temporary note.
- 02
Show the deleted path and the parent revision you recovered it from.
- 03
Explain why the recovered phrase is a procedure name and not a secret.
- 04
Normalize the phrase for the flag.
05Log your findings
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
06Write the report
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Find the commit that deleted the note. Recover the earlier version of the handover note. Read the procedure phrase without treating it as a credential. ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: pending