Why forensics preserves evidence in Cybersecurity - See It in Action

Why Forensics Preserves Evidence

📖 Scenario: You are working as a cybersecurity trainee. Your task is to understand how digital forensics preserves evidence during an investigation. This helps ensure that the evidence remains trustworthy and can be used in court or to solve a case.

🎯 Goal: Build a simple Python dictionary that lists reasons why forensics preserves evidence. Then, add a condition to filter important reasons. Finally, create a summary list of these reasons to understand their importance.

📋 What You'll Learn

Create a dictionary called evidence_reasons with exact keys and values

Add a variable called important_threshold with the value 3

Use a dictionary comprehension to create important_reasons with reasons having values greater or equal to important_threshold

Create a list called summary containing only the keys from important_reasons

💡 Why This Matters

🌍 Real World

Digital forensics experts must carefully preserve evidence to ensure it is reliable and admissible in legal cases.

💼 Career

Understanding evidence preservation is essential for cybersecurity professionals working in incident response and forensic analysis.

1

Create the evidence reasons dictionary

Create a dictionary called evidence_reasons with these exact entries: 'Integrity': 5, 'Chain of Custody': 4, 'Authentication': 3, 'Analysis': 2, 'Presentation': 1.

Cybersecurity

# Create the evidence_reasons dictionary with exact entries
# Your code here

Need a hint?

Use curly braces to create a dictionary with the exact keys and values.

2

Add the important threshold variable

Add a variable called important_threshold and set it to the integer 3.

Cybersecurity

evidence_reasons = {
    'Integrity': 5,
    'Chain of Custody': 4,
    'Authentication': 3,
    'Analysis': 2,
    'Presentation': 1
}
# Add the important_threshold variable below
# Your code here

Need a hint?

Just create a variable and assign the number 3 to it.

3

Filter important reasons using dictionary comprehension

Use a dictionary comprehension to create a new dictionary called important_reasons that includes only the items from evidence_reasons where the value is greater than or equal to important_threshold.

Cybersecurity

evidence_reasons = {
    'Integrity': 5,
    'Chain of Custody': 4,
    'Authentication': 3,
    'Analysis': 2,
    'Presentation': 1
}
important_threshold = 3
# Create important_reasons dictionary using comprehension
# Your code here

Need a hint?

Use {key: value for key, value in dict.items() if condition} syntax.

4

Create a summary list of important reasons

Create a list called summary that contains only the keys from the important_reasons dictionary.

Cybersecurity

evidence_reasons = {
    'Integrity': 5,
    'Chain of Custody': 4,
    'Authentication': 3,
    'Analysis': 2,
    'Presentation': 1
}
important_threshold = 3
important_reasons = {reason: score for reason, score in evidence_reasons.items() if score >= important_threshold}
# Create summary list with keys from important_reasons
# Your code here

Need a hint?

Use the keys() method and convert it to a list.