Digital › Module 2 › Lesson 3
Metadata Named
Metadata names data about data — timestamps, paths, hashes, EXIF — interpret on YOUR $DFIR_LAB exhibits without tampering.
Visual · t26_metadata_named
Metadata literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Files tell stories through metadata before you read a single paragraph of content.
Filesystem metadata: created/modified/accessed times (interpret with timezone and MACB rules), inode/MFT entry, parent path. File content metadata: EXIF in images, document author fields, PE headers. Cryptographic metadata: MD5/SHA-256 hashes proving integrity. Logs carry timestamps, user IDs, and source IP — all metadata for correlation. Cyberlium names metadata classes on YOUR $DFIR_LAB — document what each field means, never alter timestamps to 'fix' a timeline. Next: Types Lab.
1. Filesystem metadata (named)
MAC times: Modified, Accessed, Changed (inode/metadata change on Unix; MFT semantics on Windows — literacy not courtroom testimony here). $STANDARD_INFORMATION vs $FILE_NAME on NTFS is advanced — know timestamps can disagree.
On $DFIR_LAB, pick one file from a practice image listing and record three metadata fields — from tool output or course screenshot.
Command guide
Try these commands — Filesystem metadata (named)
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, python3. Reference sites: Evidence classification (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); Autopsy (https://www.autopsy.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Hash and exhibit metadata
Hashes are integrity metadata — tie exhibit ID to SHA-256 at intake and after each verified copy. Document tool version that produced the hash line.
Changing a single bit changes the hash — that is the point. Never edit originals to 'clean up' metadata.
3. Anti-tamper literacy
Forbidden: timestomping practice files to match a fake story, stripping EXIF to hide origin without documenting, or planting files then claiming 'discovery.' Allowed: metadata glossary with defender interpretation notes.
Ship: metadata glossary — five terms with one-line meaning each. Next: Types Lab.
4. What you ship: metadata glossary for $DFIR_LAB
Five metadata terms with definitions. $DFIR_LAB named. NEVER tamper with timestamps. chmod 600.
5. What you record before the next lesson
Date. Metadata glossary. $DFIR_LAB named. File t26-m02-l03-metadata-named.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Timestomp lab files for a 'cooler' timeline. Delete hash lines to save space.
Right
Write metadata glossary for YOUR $DFIR_LAB work. Next: Types Lab.
Mission: name metadata on YOUR exhibit
1) Define MAC times in one line. 2) Define SHA-256 role in CoC. 3) List two non-filesystem metadata examples. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
UTC + documented timezone beats arguing local offsets later.
Knowledge Check
APPLY: Metadata literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Hashes are integrity metadata tied to chain of custody.
True or False
Knowledge Check
APPLY: Timestomping practice evidence is:
Multiple choice