# System Baseline and File-Integrity Investigation

## Project summary

This controlled personal lab tested whether independent forensic indicators could identify one deliberate modification to a working copy of a macOS baseline file. No malware, unauthorized access, third-party system, or sensitive personal file was involved.

## Method

1. Established a dedicated investigation workspace.
2. Captured a basic macOS system baseline.
3. Preserved and fingerprinted the original evidence file with SHA-256.
4. Created a controlled working copy and introduced a deliberate text change.
5. Compared hashes, file sizes, text, hidden formatting, and filesystem metadata.
6. Normalized the relevant timestamps to UTC.
7. Documented findings and limitations.
8. Verified eight artifacts against a final SHA-256 manifest.
9. Completed a privacy-pattern scan before publication.

## Findings

The original and working-copy files produced different SHA-256 hashes. The working copy was 53 bytes larger and was modified 46 seconds after its creation. Text and hidden-character examination identified an added blank line, controlled-test content, a missing space, literal `|n` characters, and no newline at the end of the final line.

These independent indicators corroborated that the files were not identical. All eight investigation artifacts subsequently matched their individual entries in the final evidence manifest.

## Limitations

The filesystem evidence alone did not identify an actor, intent, originating tool, or operational security impact. This exercise demonstrates introductory evidence-integrity and comparison methods; it is not presented as a validated forensic-tool examination or a real security incident.

## Conclusion

The controlled modification was successfully detected by combining integrity verification, content comparison, metadata analysis, timeline construction, and explicit analytical restraint.