Incident response and evidence preservation

EN source master · P03-L07 · needs_review

Offline/read-only study only. Never provide secrets, passwords or authentication codes. No wallet connection, real approval, live revocation, transaction signature, transfer, funds or trade. Visuals are specifications only.

During an incident, users need to reduce exposure while recording enough nonsecret evidence for later analysis. A retrospective company report can teach that workflow if every historical claim retains its attribution.

Use the frozen source package

Dataset P03-L07-LEDGER-REPORT-20231220-v1 contains a selective paraphrased publication record and provenance file. LR01 records report/incident dates: 20 and 14 December 2023, as Ledger states. LR02 preserves grouped CET publication-time/version claims. LR03 preserves reported awareness and a remediation timeline entry; its label is not independent proof of the precise deployment instant. LR04 preserves the company's cache-propagation account. These are LEDGER-REPORTED / OFFICIAL COMPANY REPORT, not independently captured incident events.

The package was retrieved on 2026-10-01, at day precision. It is a current rendering of a retrospective publication, not a contemporaneous 2023 screenshot. It includes no native chain receipt, malware sample, npm artifact, package hash, signing log, loss figure or human attribution. Inspecting the official publication establishes that it contains the preserved statements; it does not independently authenticate their underlying chronology.

Read chronology without filling gaps

LR02 keeps affected versions and publication-time labels grouped. Do not pair each version with a time by assuming their listed order establishes one-to-one mapping. Preserve CET as the stated time basis. A historical event time, publication date and retrieval date answer different questions.

LR03's remediation statement does not establish a precise independently verified deployment instant or universal containment. LR04 reports a cache caveat, while exact last-serving time across systems is UNKNOWN in this package. A later report can describe mitigation without showing what a particular user's browser loaded. User exposure requires appropriately sourced local/software and authorization records; version labels alone cannot show an executed asset movement.

Rehearse a response, do not claim it happened

The following priority framework is pedagogical INFERRED reasoning, not a reconstruction of Ledger's or a user's actual response. First avoid continuing an unresolved interaction: no additional connection, approval, message signature or transfer. In an organizational scenario, isolate the suspect interaction/component through an established incident process. This classroom task performs no operational change.

Preserve nonsecret evidence when it is safe and quick: source URL, observed prompt summary, package name/version claim, incident-note time and collection method. Preservation should not require reloading suspect code or delay urgent containment. If preserving material would require executing malware or exposing credentials, record the gap instead. Do not make “screenshot everything first” a universal rule.

Separate artifact categories

A package-version statement is not a package binary. A package hash is not a full malware attribution. A public transaction locator is not a human identity. A user statement about a signature is not an independently observed consumed authorization. Build separate rows for company report, local artifact, authorization stage and outcome evidence. In this package, only the first category contains historical records.

A useful row includes source, locator, field/claim, source class, original time basis, retrieval time precision and what the row cannot establish. If remediation changes a system, later observations must be recorded as later contexts rather than rewriting the original evidence. Redact confidential values from any teaching submission; the security guidance excludes sharing recovery material, keys or passwords [SECURITY].

State what is known and unresolved

OBSERVED: publication metadata and the existence of LR01–LR04 statements, explicitly at company-report level. INFERRED: worksheet response priorities under the stated scenario assumptions. UNKNOWN: affected-user artifacts, consumed signatures, losses, complete cache state and human identity. INSUFFICIENT EVIDENCE: independent forensic confirmation, a particular person's blame or any claim that all users were safe after the reported fix.

Prepare a factual handoff

Your handoff should have three parts: immediate offline decision, preserved evidence inventory and targeted unresolved questions. It should never request a seed phrase, private key, password, recovery phrase or authentication code. “Please provide the nonsecret package/version source and its collection context” is a precise evidence request. “Give me your recovery material so I can investigate” is prohibited. The exercise neither signs a revocation nor moves money; actual response operations require their own trusted incident context and are outside this lesson.

• Containment: reduction of continuing exposure, distinct from complete forensic reconstruction.
• Preservation: retaining safe evidence with source and collection context.
• Company-reported: incident statement attributed to its publisher.
• Artifact: collected object with provenance, distinct from a claim about it.
• Time provenance: what a timestamp means and who supplied it.

HISTORICAL company-report record LR01–LR04 only; no independent chain/forensic artifacts. Use dataset.json and records/ledger-report.selective.json. The response worksheet proposes actions under explicit offline scenario assumptions; it adds no fictional Ledger events, wallet identities, losses or causal findings.

Evidence panel with a persistent LEDGER-REPORTED banner. Historical lane contains only LR01–LR04 and their source sections/time basis. Separate worksheet lane contains INFERRED response priorities. A third unknown-artifact lane lists package bytes, local exposure and transaction outcomes as unavailable. Never connect a package label to a human attacker or loss total.

The selected statements appear in the preserved official publication record. The worksheet can justify response priorities under explicit assumptions.

Independent incident chronology, package integrity, malware/attacker attribution, user exposure, losses, actual containment completion or a native blockchain event.

• Company narrative presented as independent forensic observation.
• Preserving evidence by re-executing suspect code.
• Delaying containment for an exhaustive screenshot sequence.
• Inferring package-to-time pairings from grouped text.
• Asking for secrets to investigate.

Create rows for LR01–LR04: source, publication/incident date, reported time basis, retrieval date/precision, package-version claim where present, evidence state and limit. Rank three offline tasks: pause unresolved interaction; preserve safe sanitized source/context; identify missing artifacts. Explain when preservation must not delay containment. Draft a factual handoff containing two UNKNOWN fields and one INSUFFICIENT EVIDENCE claim, with no secret request.

Submit a table and bounded conclusion using only supplied offline material. Editorial time allocation: study 12 min, exercise 8 min, correction/quiz 10 min.

• Contain exposure without adding live actions.
• Preserve only safely available nonsecret records.
• Keep source class and timestamp semantics.
• Retain grouped report claims without invented pairing.
• Distinguish artifact, statement and outcome.
• Keep identity/loss/complete-containment claims unresolved.

The Ledger case is usable as an attributed company-report worksheet. Safe containment priorities and provenance-aware preservation can be taught without pretending the report independently verifies events or identifies people.

• Prioritize containment and record facts without requesting secrets
• Prioritize containment without delaying it for unsafe evidence collection.
• Preserve report, package/version and timestamp provenance.
• Distinguish publication inspection from independent incident verification.

P03-L08 after prerequisite and correction review.

NONE in authoritative catalog. Provided offline data suffice; no product purchase or wallet operation required.

• [LEDGER] Ledger Security Incident Report — Attributed company chronology/package statements; no independent forensic or chain proof.
• [SECURITY] Ethereum security and scam prevention — Secret confidentiality, exact-domain checks and unofficial support caution.

Documentation explains mechanisms. Historical records retain their declared source class. Source inspection is not independent editorial acceptance.