Evidence Pack

Index redacted lab artifacts — OS logs, central test, policy, backup restore proof.

Evidence Pack• Audio Walkthrough

00:00/02:30

Visual · t16_evidence_pack

Evidence pack = table of contents for YOUR lab work. Original Cyberlium.

Investigators trust indexed evidence — not a folder called stuff_final2.

Build evidence pack index listing each capstone artifact: path, date, one-line description, redaction note. Include OS log lab, central forward confirmation, policy lab file, backup restore log, hardening checklist references from earlier modules. All from $LAB — no employer tickets, no classmate logs, no production screenshots without authorization. chmod 600 index.

1. Index fields

Artifact name, module lesson, file path, UTC date, description, redactions applied.

Cross-link checklist item to artifact row.

Command guide

Try these commands — Index fields

═══ LINUX / KALI (Penetration Testing & Service Audit) ═══

Port scan and service banner grabbing against authorized target

Command — copy this

nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}

Enumerate web directories and hidden endpoints

Command — copy this

gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hosts

Metasploit framework module inspection (Safe lab syntax)

Command — copy this

msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"

═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings

Command — copy this

netstat -ano | findstr /i "LISTENING"

Primary tools to practice this lesson: journalctl, python3, ss. Reference sites: Evidence pack (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); NIST SP 800-92 (https://csrc.nist.gov/publications/detail/sp/800-92/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.