The Glass Witness
Six surviving evidence panes challenge the official history of Ash Vex's visit to Orison Clinic. Act as an independent examiner: recover what each pane still reveals, distinguish authentic fragments from an authentic sequence, and build an evidence ledger before deciding who should control the reconstructed record.
Learning goals
By the end of this track, you will be able to:
- distinguish visual concealment from removal of underlying data;
- recover useful provenance from image metadata;
- verify file integrity against a published digest manifest;
- normalize timestamps with signed UTC offsets into one chronology;
- explain why an object identifier is not an authorization decision;
- show how authentic records can produce a false result when their order is not protected; and
- separate direct observations, supported conclusions, and ethical choices.
Before you begin
Connect to the assigned Pocket CTF network and open the game as described in the connection guide. Read the scenario-track workflow and keep an evidence log with the artifact, observation, tool or action, and interpretation for every finding. The glossary defines shared evidence, web, and cryptography terms.
Work only with the provided panes, downloads, and linked record interval. The board is a small, single-threaded device: send one request at a time and do not scan, flood, or brute-force it. Although the case is fictional, its records model sensitive health, identity, and consent data. Treat access to a record as an opportunity to document a control failure, not as permission to explore outside the exercise.
Recommended tools
- Browser and developer tools: Inspect received HTML, styles, links, and forms without changing the device.
- Text editor and metadata viewer: Review downloaded evidence as structured data rather than relying only on its visible rendering.
- Hashing tool: Calculate SHA-256 locally and compare every artifact with its corresponding manifest entry.
- JSON viewer and evidence table: Preserve identifiers, sequence numbers, scope fields, timestamps, and relationships while comparing records.
- Timeline workspace: Paper, a spreadsheet, or a text table can normalize local timestamps into one common time zone.
The student guide provides safe file, metadata, hashing, JSON, and time-conversion recipes.
Modules
| Module | Focus | Estimated time |
|---|---|---|
| The Covered Name | Visual redaction and underlying HTML | 25 min |
| Portrait of Static | PNG metadata and provenance | 30 min |
| Hairline Fracture | SHA-256 manifest verification | 35 min |
| Four Rooms, Four Clocks | Signed offsets and chronology | 35 min |
| The Memory Next Door | Object references and authorization | 40 min |
| Consent in the Wrong Order | Sequence integrity and replay | 50 min |
Suggested pacing
Complete the panes in order when learning the techniques for the first time. Each pane has two ledger findings: one central finding reveals its witness seal, while the supporting finding strengthens the final account. Copy each revealed seal and file it manually on the escrow index; recording a finding does not file the seal for you. Filing requires that pane's central finding in the same active session; an unearned seal is rejected without consuming a failed-flag attempt. Revisit the pane to retrieve its earned seal, or repeat the accepted finding to display it again without adding progress. Supporting findings are optional and remain available after filing and after choosing an ending.
Partners may divide tool operation and note-taking, but each learner should be able to connect an observation to the conclusion it supports. Pause before the final pane to compare which controls protect individual artifacts and which controls protect relationships among artifacts.
Completion and reflection
The required track is complete when all six witness seals have been filed. A stronger reconstruction records all twelve ledger findings. After the seals are filed, the case offers three disposition choices. No choice is designated as the single correct ethical answer; evidence coverage changes how well each choice is supported.
Before choosing an ending, ask:
- Which pane confused hiding information with removing it?
- Which conclusion required comparing an artifact with an external claim?
- Where did every individual record remain authentic while the history became unreliable?
- Which observations establish a technical failure, and which judgments concern privacy, accountability, or agency?