Lab — Acquisition

Pack imaging, hashing, and write-blocker checklists — acquisition literacy file from $DFIR_LAB only.

Lab — Acquisition• Audio Walkthrough

00:00/02:48

Visual · t26_acquisition_lab

Lab: acquisition pack. $DFIR_LAB only. Original Cyberlium.

Acquisition pack merges format, hash, and blocker habits — paperwork before disk analysis module.

Lessons 3-1–3-3 named imaging formats, hash integrity, and write blockers. This lab merges imaging card, hash log stub, and acquisition safety checklist with $DFIR_LAB authority reference. No stranger-hardware imaging — acquisition paperwork acceptable. Next: Quiz — Acquisition Literacy.

1. Lab contract: acquisition pack

Create $HOME/cyberlium-lab/t26-m03-l04-acquisition-lab.txt merging imaging card, hash log stub, blocker checklist, and CoC cross-reference from M1.

Optional: verify hash of course practice image against published value — still no unauthorized targets.

Command guide

Try these commands — Lab contract: acquisition pack

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Optional command

OpenSSL dgst — https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html

NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds Sleuth Kit — https://www.sleuthkit.org/ (image verification context)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install openssl

macOS: Built-in

Windows:

Command — copy this

choco install openssl

═══ LINUX / macOS ═══

Command — copy this

export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
mkdir -p "$LAB_DFIR/evidence/analysis"
cp -p "$LAB_DFIR/evidence/sample.bin" "$LAB_DFIR/evidence/analysis/sample.bin"
grep refuse "$LAB_DFIR/notes/write-blocker-policy.txt"
sha256sum "$LAB_DFIR/evidence/sample.bin" "$LAB_DFIR/evidence/analysis/sample.bin"
openssl dgst -sha256 "$LAB_DFIR/evidence/sample.bin" | tee "$LAB_DFIR/evidence/sample.bin.openssl.sha256"
grep -E 'sample.bin|SHA256' "$LAB_DFIR/evidence/sample.bin.openssl.sha256"

═══ WINDOWS ═══

YOUR lab Windows VM — hash YOUR sample copy

Command — copy this

Copy-Item $HOME/cyberlium-lab/t26-dfir/evidence/sample.bin $HOME/cyberlium-lab/t26-dfir/evidence/analysis/sample.bin
Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/sample.bin -Algorithm SHA256
Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/analysis/sample.bin -Algorithm SHA256

Primary tools to practice this lesson: sha256sum, openssl, grep. Reference sites: OpenSSL dgst (https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); Sleuth Kit (https://www.sleuthkit.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check ethics

Grep for dd commands aimed at /dev/sd? without scope, 'ignore hash fail,' or stranger device IDs — remove. Pack stays literacy and safety.

Confirm notes reference $DFIR_LAB authority card from M1.

3. Lock the proof

chmod 600 on the pack. Quiz next — then Disk and Filesystem.

Acquisition literacy feeds Autopsy and filesystem lessons in M4.

4. What you ship: acquisition literacy pack for $DFIR_LAB

Merged imaging, hash, blocker sections. $DFIR_LAB named. NO stranger hardware. chmod 600.

5. What you record before the next lesson

Date. Acquisition pack path. $DFIR_LAB named. File t26-m03-l04-acquisition-lab.txt chmod 600.

6. Wrong vs right: tampering evidence vs chain of custody

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Include live imaging commands against neighbor PC. Skip hash verify step.
Right: Write YOUR acquisition pack for $DFIR_LAB. chmod 600. Next: Quiz — Acquisition Literacy.

Hands-on Exercise