Forensic Workflow: From Symptom to Commit

Forensic Workflow: From Symptom to Commit

Module: Module 10: Advanced Debugging and Forensics Project

A strong Git investigation moves from symptom to candidate commits to proof. The goal is not to scan history randomly; it is to reduce uncertainty systematically.

Start with a reproducible symptom and a known good point. Use log and diff to identify likely areas, pickaxe to search for specific strings or behavior, blame to find context, and bisect when the regression point is unknown. Each tool narrows the search from a different angle.

Write down the question before running commands. For example: when did this config key become required, which release first included this behavior, or which commit removed this validation? Clear questions produce clear command choices.

Command Walkthrough

git log --oneline -- app.conf
git log -S'required_key' -- app.conf
git blame -L 1,40 app.conf
git bisect start HEAD v1.0.0
git show <suspect-commit>

Bisecting: 2 revisions left to test after this (roughly 2 steps)
[abc1234] Change application mode

Hands-on Lab

Introduce a config regression and investigate it with at least three tools: log, pickaxe, and bisect. Document the command that gave the decisive answer.

What to Watch For

• Do not stop at the first suspicious commit. Prove the behavior changed there.
• A commit can reveal the symptom while the design decision happened earlier.
• Investigation notes are valuable review artifacts. Put them in the issue or PR.

Completion Check

You should be able to explain what each command changed, inspect the resulting history, and describe how you would undo or recover from the operation before using it in a shared repository.