This manual is for IT-FPX4075 Assessment 1, start to submission. The opening deliverable in Computer Forensics is normally a planning and handling document: somebody hands you a case, and you decide what to collect, in what order, under what protection, and then prove on paper that the evidence you produced could be trusted by a reader who was not in the room. Nothing here pays for recovery tricks. The marks sit in the sequence you chose, the write protection you named, the digests you recorded at both ends, and a custody table with no unexplained hour in it. Below is the method our tutors use for it, a structure that maps to the criteria, and an annotated sample excerpt. Prefer to hand it off? A premium original sample for this exact assessment comes back in 24 to 48 hours, revised free until it meets the guide. Your courseroom may print this as IT FPX 4075 Assessment 1 or IT4075 Assessment 1; it is the same deliverable, and IT-FPX4075 Assessment 1 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4075 Assessment 1 is scored
FlexPath hands out no letter grades. Each criterion on your scoring guide lands on one of four levels, and the wording of those levels is the writing brief:
| Level | What it means on an acquisition plan |
|---|---|
| Distinguished | The collection order is justified, the live capture decision is argued both ways before you choose, and the plan states what it cannot recover. Every criterion carries one extra move; find it and make it. |
| Proficient | Every required element is present and technically correct. Sound work, and one piece of reasoning short of the top of the guide. |
| Basic | A sequence of steps with no reasoning attached to any of them, which is where most first attempts in this course land. |
| Non-performance | Something required is absent, usually verification or custody. The floor is reached by omission rather than by weak writing. |
Treat this document as the foundation for the rest of the course rather than as an exercise you clear. The examination you write later can only report on evidence that this plan made trustworthy, and a digest you never recorded is a digest you cannot produce when a reader asks for it.
The IT-FPX4075 Assessment 1 method, step by step
-
Read the criteria before you read the case
The scenario tells you what happened; the scoring guide decides what you are paid for. Make each criterion row a heading in your outline and park its top-level description underneath before you plan a single collection step. Where a row asks you to justify a decision, the justification is the deliverable, and a correct choice with no reasoning attached scores below a defensible one.
-
Write the question the collection has to answer
One sentence at the top of your notes. In a case where an architecture firm's departing project manager is suspected of copying drawing files to personal media, the question is whether that copying happened in the two weeks before the resignation. Device connection records, file access history, and volume identifiers serve that question. A browser cache from a shared workstation does not, and an examiner who collected it anyway has scope to explain.
-
State the authority and draw the boundary
Name who authorized the examination, what the authorization covers, and what it excludes. Counsel's instruction naming one assigned laptop and one USB device does not reach the desk of the colleague next to it, and the criteria treat an unbounded search as a defect rather than as diligence. Fix the boundary in writing early so every later section stays inside it.
-
Order the collection by how fast the data disappears
Registers and cache go first, then memory, then network state and running processes, then temporary files, then disk, then archived backups. The hard call is whether to capture memory from a running machine and accept a small alteration, or pull power and lose everything volatile. Argue whichever you choose, because the grade rests on the argument rather than on the answer, and only an unexplained decision is wrong.
-
Specify protection, imaging, and verification together
Name the hardware write blocker or the verified software equivalent, say the image is bit for bit rather than a file copy, and record the digest algorithm with the value computed on the source and again on the image. Budget the clock honestly: a 256 gigabyte drive read over a connection sustaining about 210 megabytes per second is roughly 20 minutes, and the verification pass that recomputes the digest takes about as long again.
-
Self-score the plan, then upload early in the week
Read your draft against the guide one row at a time and mark yourself D, P, B, or N without generosity. Any row below the top gets one more pass, and the pass is almost always a sentence that explains a choice you had merely stated. Submit early, since a FlexPath evaluation can take two business days and a Thursday upload can sit until Monday.
A structure that maps to the criteria
The word counts are planning targets our tutors use for a handling plan of this kind, not Capella rules; stretch whichever section your scoring guide weights most heavily.
| Section | What it must do | Guide |
|---|---|---|
| Authority and scope | Who authorized the work, what the authorization covers, what it deliberately excludes, and the question to be answered. | ~150 words |
| Evidence inventory | Every item to be collected, described so a stranger could pick it out: make, capacity, serial or asset number, and where it was found. | ~200 words |
| Collection order | The volatility sequence, the live capture decision put both ways, and the reason the chosen option wins in this case. | ~350 words |
| Protection and verification | The blocking method, the imaging approach, the digest algorithm, the values at both ends, and how many working copies exist. | ~300 words |
| Custody and storage | The transfer log row by row, where evidence rests between steps, and who holds physical access to it. | ~200 words |
| Limitations and sources | What this plan cannot recover, what could still go wrong on the day, and procedural references in current APA. | ~150 words |
Annotated sample excerpt
An original model paragraph from our team, written in the register the top of the guide describes. Treat it as study material rather than as a template, and write your own once you can see what each sentence is doing.
Counsel's written instruction of 12 March authorizes examination of one assigned laptop, asset tag AR-1148, and one unlabeled 32 gigabyte USB device recovered from the same desk, and it authorizes nothing else on that floor.1 The laptop was found powered on and locked, so memory will be captured first with a documented acquisition tool at 09:14 local time, recorded as 14:14 UTC, before the machine is shut down and the internal drive imaged through a hardware write blocker.2 Memory collection alters the running system by the footprint of the collection tool, which is disclosed here rather than left for somebody else to notice, and the cost is accepted because the volume is protected by full disk encryption and a powered-off image may prove unreadable.3
- 1Authority and boundary in the opening sentence, with a date and an asset number. An evaluator can see at once that the examination has edges, which is the element most plans leave out.
- 2The order arrives as a decision rather than as a habit, and every time carries a zone. A sequence built from unlabeled clocks cannot be reconciled with anything outside the machine.
- 3Names the alteration, prices it against the alternative, and discloses it in advance. Disclosed change is survivable, and undisclosed change is the thing that ends a case.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- A plan with no authority section. Collection that nobody authorized in writing is a problem no later analysis repairs.
- Collection order asserted rather than argued. Listing volatility in the right sequence reaches Proficient; explaining why you accepted the trade-off reaches the column above it.
- One digest with nothing to compare it against. A single value proves a file existed, not that your copy matches the original.
- Custody rows with an hour nobody owns. Every unexplained interval is an opening to argue the evidence moved unrecorded.
- A collection wider than the question. Material gathered with no case reason to be there becomes a finding against the examiner, whatever it turns out to contain.
Pre-submission checklist
- The authorizing instruction is named, dated, and quoted for what it covers
- One sentence near the front states the question the examination must answer
- Every item of evidence is identified by make, capacity, and serial or asset number
- The live capture decision is argued in writing, whichever way it went
- Digest algorithm, source value, and image value all appear, with working copies accounted for
- Self-scored at the top level on every criterion, uploaded early in the week
Acquisition plan due this week?
Send the scenario, the criteria, and whatever the courseroom told you about the media. A premium original comes back inside 24 to 48 hours with the order justified, both digests recorded, and a custody table that has no gaps in it. Revision continues at no cost until the guide is satisfied.