Today's Forensics Workshop began with a surprise note from Ernie indicating that he had played a prank on the crime scene. After further investigation, Ernie claimed that he did not send the email in question so the class had an expert system admin help them discover the true origins of the incriminating email. Using various commands, Steve taught the students how to use the command line interface using commands like cd, ls, man, mkdir, and ping. Steve proved that the email was taged with the computer name "synapse-95." By "pinging" this computer name, the class found the IP address of the computer that sent the email. Steve then had the investigators use the AWD command to find the MAC address, which they used to see the real name of the computer that sent "Ernie's" email. It turned out that the MAC address was from a laptop named "Alexandra's Macbook."
After a short break, the workshop students compared various fingerprints to the one found at the crime scene. They found prints which were a very close match to Alexandra's around the scene. Each student was given a piece of evidence to focus on and present before a mock jury in "court." The jury of apprentices decided to rule Alexandra guilty for not giving the apprentices cookies. Afterwards, the students completed reflections and were rewarded with cookies for all of their hard work.