Checklist

Topic 26 capstone checklist — DFIR mindset, acquisition, analysis, timeline, reporting on $DFIR_LAB.

Checklist• Audio Walkthrough

00:00/02:45

Visual · t26_capstone_checklist

Checklist consolidates DFIR literacy pillars. $DFIR_LAB only. Original Cyberlium.

Capstone proves DFIR literacy on YOUR authorized practice evidence — not a portfolio of stranger device dumps.

Assemble checklist covering Modules 1–9: DFIR mindset and CoC, evidence types, acquisition and hashing, disk/filesystem, memory, net/logs, timeline/correlation, reporting/legal, case practice. Use on capstone walk of YOUR $DFIR_LAB — never unauthorized acquisitions, planted evidence, or forged logs. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $DFIR_LAB only, legal authority stated, hashes verified, limitations documented, no tampering.

1. Scope and ethics

$DFIR_LAB named with authority reference. NEVER unauthorized device access, NEVER plant/tamper, NEVER forged logs.

Practice label when brief requires — honesty in capstone.

Command guide

Try these commands — Scope and ethics

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: grep, python3. Reference sites: Capstone checklist (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.