Label: ungraded Forensics and steganography module case.
About fifteen minutes. Use the supplied packet and keep the reasoning in notes.

Write one provenance line, one supported clue, and one limit for each row.

1. benign-note.txt is named like a text note. Offset 0 is the PNG signature.
   Supported clue: the leading bytes. Limit: a decoder has not confirmed the image.
2. metadata-table.txt Comment is spare cable. The JPEG file does not hold that tag.
   Supported clue: the card's Comment line. Limit: the DateTime line has no zone and was typed.
3. combined.bin places the PNG signature at offset 5 after NOTE and a line feed.
   Supported clue: the author offset. Limit: scan.txt is not a binwalk transcript.
4. owned-carrier.png contains a tEXt Comment, night lamp, because this lesson put it there.
   Supported clue: that chunk. Limit: other hiding methods were not inspected.
5. stream.txt activity body is ribbon. No capture file exists.
   Supported clue: the typed body. Limit: an encrypted payload without secrets is a different card.
6. On 2026-04-02 UTC, access R-19 is 11:00:09 and the auth ok for R-19 is 11:00:12.
   Supported clue: the order of those two stamps. Limit: the account label is not a person.
7. The memory model at 10:00 lists PID 422 as lamp-index.
   Supported clue: that row. Limit: the table is not every past login.

Stop when the seven limit lines are written. Do not acquire a real image, log, or capture.