Lab — Case

Full case lab on $DFIR_LAB — dataset inventory, workflow walk, report from timeline, pitfalls review.

Lab — Case• Audio Walkthrough

00:00/02:45

Visual · t26_case_lab

Lab: end-to-end case on YOUR $DFIR_LAB practice dataset. Original Cyberlium.

Run one practice case intake to handoff — every station documented, every exhibit hashed, every pitfall checked.

On YOUR $DFIR_LAB authorized practice dataset: (1) dataset inventory card with verified hash; (2) workflow diagram with UTC milestones filled; (3) analysis summary linking Modules 4–7 artifacts; (4) Module 8 report lab pack updated or merged; (5) pitfalls checklist with five near-miss fixes; (6) handoff index chmod 600; (7) integrity — no unauthorized sources, no tampering, practice label if brief requires. Minimum one net/logs correlation and one timeline hypothesis with falsification. Revert mounts and snapshot after if brief requires.

1. End-to-end deliverables

Inventory + workflow + report + pitfalls + index — single case ID.

Cross-link all exhibit IDs across modules.

Command guide

Try these commands — End-to-end deliverables

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, grep. Reference sites: Autopsy + CFReDS (https://www.autopsy.com/); Volatility samples (https://www.volatilityfoundation.org/); SANS FOR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.