Station Computer: Diagnosing a Shared Terminal Before the Night Shift
A police station has one shared desktop used for FIR entry, a printer, and a USB drive that officers use to carry scanned documents between rooms. Before the night shift, a constable reports: the machine boots normally, but the FIR software opens very slowly, the printer shows offline, and a folder on the USB drive shows files with unfamiliar extensions and one file named like a document that will not open. Another officer says he plugged in a USB drive he found in the duty room. The station has no internet connection tonight, one spare USB drive known to be clean, and a written instruction that no unauthorised media may be connected. The constable must restore FIR entry before the shift and decide what to do with the suspect drive.
1. Rank the likely causes of the three symptoms and explain which single symptom is the most serious from a security standpoint.
Read the worked answer
Ranking of likely causes:
- Malware from the unknown USB drive - best explains the combination: slow software, a printer going offline, and renamed files with odd extensions. A single cause explaining several symptoms usually beats several separate causes.
- Printer configuration or cable fault - plausible on its own, but does not explain slow software or the odd files.
- Aging hardware or low disk space - could slow the FIR software, but would not rename files or take the printer offline.
Most serious symptom: the unfamiliar files with odd extensions on the USB drive, especially the file disguised as a document. Slow software and an offline printer are inconveniences; a disguised file is a likely attempt to get a user to open something harmful, and the officer's admission that he plugged in a found drive makes this the probable entry point.
Reasoning principle: treat the unknown drive as the common cause until disproved, because the symptoms appeared together and one of them is a known attack pattern.
2. Give the constable an ordered recovery plan that restores FIR entry for the shift while containing the risk, using only the resources named.
Read the worked answer
Ordered plan:
- Stop using the suspect drive. Do not open the disguised file. Remove the drive and label it as evidence or for examination; note who found it and where.
- Disconnect the machine from the printer and from any network cable so nothing spreads and the printer is not used to carry infection.
- Run a full scan with the station's antivirus if installed, and note findings. If no tool is available offline, proceed to the fallback.
- Fallback for FIR entry: use the known-clean spare USB drive only after scanning it, and if the FIR software cannot be trusted, record the FIR on paper in the interim so no legal deadline is missed. Paper first, then entry when the machine is clean.
- Restore the printer after the machine is clean: check power, cable, and the offline setting, then print a test page.
- Log everything - time, symptoms, actions, who handled the drive - because the station may need to explain any delay in FIR entry.
The controlling idea: protect the legal record first, contain the media second, repair convenience last.
3. The officer who plugged in the found drive asks whether he should just delete the strange files and carry on. Respond, explaining why deletion is the wrong move and what policy lesson follows.
Read the worked answer
Deletion is the wrong move for three reasons:
- It destroys evidence. The files may identify what the drive was meant to do and who prepared it. Deleting them removes the chance to investigate and to warn other stations.
- It does not remove the cause. If malware is running, deleting visible files leaves the active part in place. The symptoms would continue and the officer would wrongly believe the problem solved.
- It hides a reportable event. A found drive plugged into a police terminal is a security incident. Quietly cleaning up prevents the station from recording and learning from it.
Correct response: preserve the drive, report the incident, and let the designated person examine it.
Policy lesson: the written rule against unauthorised media exists precisely because a found drive is an attractive nuisance. The station should pair the rule with a practical alternative - a designated clean drive and a habit of handing found media to the duty officer - because a rule with no convenient alternative gets broken. Training should also teach officers to recognise a file that pretends to be a document but is not.