The Weekend Posts

The captions in a short social feed do not name a protected source. Determine whether structured metadata links the posts to evidence from earlier stations.

Objective

By completing this module, you will be able to:

navigate nested JSON records and preserve record identifiers; and
correlate location and managed-device metadata across artifacts.

Before you begin

Complete at least The Byline Photo and The Pitch PDF, and keep those evidence notes available. Review JSON and JSON Lines.

Concepts

Correlation joins records through shared values. A location repeated across an image and a post can link activities; an organization-specific device identifier can associate an editing session with managed equipment. Common device models or time zones are weaker evidence because many people share them.

Three preserved artifacts feed a comparison of identifiers, times, and provenance. Observations are separated from inference, with uncertainty carried into the finding.

Preserve each artifact and record its source before comparing identifiers, timestamps, and provenance. A repeated value can link records, but shared origin or copied data may make evidence dependent. Separate observed facts from inferred relationships, note conflicting explanations, and state the limits of the resulting finding. Correlation alone does not prove causation.

Suggested tools

JSON formatter: A browser viewer, editor, or python3 -m json.tool feed.json exposes nested fields clearly.
Evidence table: Compare post ID, timestamp, coordinates, device fields, and identifiers with earlier findings.

Tool practice

Rehearse the worked tool exercise before using challenge data.

First identify whether the top-level JSON is an object or array. Navigate to each post, then its client_metadata object. Keep the parent post ID on the same row as every nested observation; compare location values with your saved photo notes.

Investigation

Observe

Inventory every post ID and its nested client_metadata. Separate ordinary device descriptions from precise locations and organization-specific tags.

Form a hypothesis

Which post repeats the photo's location? Which field links an editing session to managed organizational equipment? How strong is each link independently?

Test carefully

Submit the relevant post ID, its shared coordinate pair, and the managed-device tag as separate findings. Use exact structured values rather than paraphrases.

Progressive hints

The in-app nudge is: “Which independent details connect these posts?” The guidance below offers further help when needed.

Hint 1

Pretty-print the feed and compare each client_metadata object.

Hint 2

Compare the nested geo value with the coordinate recorded from the photo.

Hint 3

The strongest organizational link is a field explicitly identifying managed equipment, not the laptop model, browser, or time zone.

Troubleshooting and reset

If the JSON appears on one line, format it without changing its values. Preserve punctuation and capitalization when copying identifiers. Closing the audit locks further submissions for the current browser session; start a fresh session if you closed it early.