The digital-evidence intake 场景学习单

An unlocked phone passes between several desks while screenshots are copied into personal message threads.

一部未锁定的手机在多个工位间传递，截图被复制进私人聊天。

DETECTIVE

The pattern is obvious. Let me search everything before the owner changes the account.

模式已经很明显了。趁机主修改账户前，让我搜索所有内容。

EXAMINER

A brilliant interpretation cannot repair evidence whose origin and handling are unknown.

再精彩的解读，也无法修复来源和处理过程不明的证据。

EXAMINER

Confirm legal scope, photograph the device, isolate it from networks and preserve an exact acquisition with a verified hash.

确认合法范围，拍摄设备状态，隔离网络，并用经验证的校验值保存精确取证副本。

DETECTIVE

We will analyze a working copy, log every access and seek new authority before opening data outside the approved scope.

我们会分析工作副本，记录每次访问；打开获准范围之外的数据前，先取得新的授权。

The group returns to the opening concern—“The pattern is obvious. Let me search everything before the owner changes the account.”—and compares it with the later response before closing the scene.

众人重新审视开场问题——“模式已经很明显了。趁机主修改账户前，让我搜索所有内容。”——并在结束场景前把它与后续回应进行比较。

DETECTIVE

What shared result are we producing, who owns each part, which dependency comes first, and how will completion be confirmed?

我们要共同产出什么结果，每部分由谁负责，哪个依赖先发生，又怎样确认完成？

EXAMINER

Each task will have one owner, a visible definition of done, a handoff point, an update time, and a route for blocked work.

每项任务都会有一名负责人、可见的完成定义、交接点、更新时间和受阻时的升级路径。

Two phrases remain visible on the shared note: “legal scope” and “a verified hash,” each linked to the exact line that gives it force in the discussion.

共用记录上保留两个表达：“legal scope”（合法权限范围）与“a verified hash”（经验证的校验值），并分别连接到赋予其讨论力量的原句。

DETECTIVE

The team will repeat the final division of work and reopen it if capacity, evidence, or the shared goal changes.

团队会复述最终分工，并在能力、证据或共同目标变化时重新讨论。

The longer passage makes cooperation concrete through ownership, sequence, feedback, handoff, and a review trigger.

加长段落通过责任、顺序、反馈、交接和复盘触发条件，让协作变得具体。

A second pass through “The digital-evidence intake” slows the exchange where “The pattern is obvious. Let me search everything before the owner changes the account.” still leaves motive, consequence, or responsibility unstated.

第二轮细读“The digital-evidence intake”时，交流在“模式已经很明显了。趁机主修改账户前，让我搜索所有内容。”仍未说明动机、后果或责任的位置慢下来。

EXAMINER

Where could this handoff fail, who notices first, and what information must travel with the work so the next person can continue safely?

这次交接可能在哪里失败，谁会最先发现，又有哪些信息必须随工作一起传递，才能让下一位安全继续？

DETECTIVE

The plan will show the shared outcome, task owners, sequence, dependencies, review standard, blocked-work route, and final acceptance owner.

计划会显示共同结果、任务负责人、顺序、依赖、复核标准、受阻处理路径和最终验收负责人。

The speakers test how “legal scope” changes the force of “a working copy,” then restate the distinction without relying on either phrase.

说话者检验“legal scope”（合法权限范围）如何改变“a working copy”（工作副本）的语气力度，然后不依赖这两个短语重新说明区别。

DETECTIVE

Everyone helping is not the same as everyone knowing who decides, who delivers, and who verifies.

所有人都在帮忙，并不等于所有人都清楚谁决策、谁交付、谁验证。

EXAMINER

We will repeat the handoff in order, remove one ambiguous responsibility, and set a checkpoint before the next dependency becomes irreversible.

我们会按顺序复述交接，消除一项含糊责任，并在下一个依赖变得不可逆前设置检查点。

They rehearse one careful version, one direct version, and one version for a listener who enters late, checking that “a verified hash” still leads to the same next step.

他们分别排练谨慎版、直接版和面向迟到听众的版本，检查“a verified hash”（经验证的校验值）是否仍然导向同一个下一步。

Before the scene closes, “legal scope” and “a working copy” are placed beside the unresolved pressure in “The digital-evidence intake,” giving the speakers one more round to challenge, concede, reframe, and hand off the decision.

场景结束前，“legal scope”（合法权限范围）与“a working copy”（工作副本）被放回“The digital-evidence intake”尚未解决的压力旁，让说话者再完成一轮质疑、让步、重述与交接。

DETECTIVE

If one teammate misses the next handoff, which dependency breaks, who can make the temporary decision, and what context must be visible before work continues?

如果一名队友错过下一次交接，哪个依赖会断裂，谁能作出临时决定，又必须先公开哪些背景才能继续工作？

EXAMINER

I can admit that my part looked complete from my seat while still leaving another person without the file, authority, or explanation required to finish theirs.

我承认自己的部分从本岗位看似完成，却仍可能让他人缺少完成其任务所需的文件、权限或说明。

DETECTIVE

Then completion means the next person can act, question, and recover without private context, not merely that the previous person stopped working.

那么完成意味着下一位可以在不依赖私人背景的情况下行动、提问和恢复，而不只是上一位停止了工作。

DETECTIVE

I will transfer the current state, decision history, unresolved dependency, owner, deadline, and fallback, then ask the receiver to restate the first action.

我会交接当前状态、决策历史、未解依赖、负责人、期限和备用方案，再请接手者复述第一个行动。

The longer dialogue now leaves “The digital-evidence intake” with an acknowledged objection, a revised frame, a named owner, and a handoff that can be checked after the conversation ends.

更长的对话让“The digital-evidence intake”在结束时留下已被承认的异议、经过修订的框架、具名负责人，以及能在谈话结束后继续核验的交接。

The fuller scene turns goodwill into coordination that survives delay, disagreement, and a change of owner.

更完整的场景把善意变成能够经受延误、分歧和负责人变更的协作。

The phone enters sealed storage while the team receives a scoped forensic copy and access log.

手机进入密封存储，团队获得范围受限的取证副本和访问日志。