Lattice Trail
You are the publication editor for a feature about a surveillance company. Before publication, review six artifacts for details that could expose a source. Each artifact is a separate station, but the strongest conclusions come from comparing evidence across the complete trail.
Learning goals
By the end of this track, you will be able to:
- inspect image, PDF, text, HTML, and JSON artifacts for hidden or unnecessary disclosures;
- distinguish visible redaction from removal of underlying data;
- explain how individually ordinary details become identifying when correlated;
- classify third-party web requests by the privacy risk they create; and
- recommend proportionate ways to remove, generalize, or isolate risky data.
Before you begin
Connect to the assigned Pocket CTF network and open the game as described in the connection guide. Read the scenario-track workflow and keep an evidence log with the artifact, observation, tool, and interpretation for every submitted finding.
Work only with the provided exercise artifacts. Downloaded files are synthetic, but they model information that can be sensitive in real reporting. Do not apply the techniques to people or systems outside the authorized exercise.
Recommended tools
- Browser and text editor: Download artifacts and inspect text or source.
- Metadata viewer:
exiftoolis useful for images and general file metadata; an accessible graphical metadata viewer is also suitable. - PDF utilities:
pdfinfoandpdfdetachinspect document properties and attachments. A graphical PDF attachment panel is an alternative. - JSON viewer: A browser viewer, editor formatter, or
python -m json.toolmakes nested records easier to compare.
The student guide provides safe recipes for these tool categories.
Modules
| Module | Focus | Estimated time |
|---|---|---|
| The Byline Photo | Image location metadata | 25 min |
| The Pitch PDF | PDF authorship and software metadata | 30 min |
| Working Notes | Data minimization across text files | 35 min |
| The Lawsuit Filing | Redaction and embedded attachments | 40 min |
| The Portfolio Page | Third-party web data flows | 35 min |
| The Weekend Posts | Cross-artifact correlation | 45 min |
Suggested pacing
Complete the modules in order. The first five teach evidence types used by the final correlation exercise. Partners may share tool operation, but each learner should record and explain their own findings. After surfacing a station's story-critical risk, copy its audit seal and file it on the track index. Continue looking for supporting findings before moving on when time permits.
If you lose a seal response, reopen its station or repeat the accepted finding in the same browser session. The earned seal remains available while the review is open. Repeating a finding reports Already recorded without adding findings or progress; you still file the seal manually on the track index.
Closing the publication review makes the current record final for that browser session. Do not close it until you are ready to compare your evidence with the closure report.
Completion and reflection
The required track is complete when all six station seals have been filed. A stronger investigation also accounts for every recoverable finding and explains how the findings combine into a source-identification risk.
Before closing the review, ask:
- Which artifact appeared safest before you inspected its hidden structure?
- Which risk became clear only after two artifacts were compared?
- Which remediation requires removal, and which can be handled by generalization or an alternative service?