SUSA-083 / CASE WORKSHEET
Examiner / examination time and time zone:
Training scope: synthetic cache examination, no real acquisition.
Source context: copy from source-context.txt; distinguish supplied context from your findings.
Viewer versions, source URLs, executable paths and SHA-256:
Database / source SHA-256 / working SHA-256 / match?:

THUMBS VIEWER
Database path / System / unfiltered entry count:
Filename / Entry Size / Sector Index / Date Modified (UTC):
Selected image filename / CSV filename / output SHA-256:

THUMBCACHE VIEWER
Database path / System / unfiltered count / filtered count:
Cache Entry Hash / Cache Entry Offset / Data Offset / Data Size:
Filename / dimensions if available / checksum verification result:
Selected image filename / CSV filename / output SHA-256:

COMPARE AND REPORT
Visual comparison / image dimensions / same or different SHA-256:
Observation (what the selected records display):
Interpretation and confidence (what that supports):
Limits (original path, actor, precise viewing time, original file existence):
Corroboration actually examined: none supplied in this pack.
Next check: name one artefact, search term or identifier, and what you would test.
Reproduction check / gaps / handover location outside VM: