Digital › Module 3 › Lesson 4
Lab — Acquisition
Pack imaging, hashing, and write-blocker checklists — acquisition literacy file from $DFIR_LAB only.
Visual · t26_acquisition_lab
Lab: acquisition pack. $DFIR_LAB only. Original Cyberlium.
Opening
Acquisition pack merges format, hash, and blocker habits — paperwork before disk analysis module.
Lessons 3-1–3-3 named imaging formats, hash integrity, and write blockers. This lab merges imaging card, hash log stub, and acquisition safety checklist with $DFIR_LAB authority reference. No stranger-hardware imaging — acquisition paperwork acceptable. Next: Quiz — Acquisition Literacy.
1. Lab contract: acquisition pack
Create $HOME/cyberlium-lab/t26-m03-l04-acquisition-lab.txt merging imaging card, hash log stub, blocker checklist, and CoC cross-reference from M1.
Optional: verify hash of course practice image against published value — still no unauthorized targets.
Command guide
Try these commands — Lab contract: acquisition pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL dgst — https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html
NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds Sleuth Kit — https://www.sleuthkit.org/ (image verification context)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
mkdir -p "$LAB_DFIR/evidence/analysis"
cp -p "$LAB_DFIR/evidence/sample.bin" "$LAB_DFIR/evidence/analysis/sample.bin"
grep refuse "$LAB_DFIR/notes/write-blocker-policy.txt"
sha256sum "$LAB_DFIR/evidence/sample.bin" "$LAB_DFIR/evidence/analysis/sample.bin"
openssl dgst -sha256 "$LAB_DFIR/evidence/sample.bin" | tee "$LAB_DFIR/evidence/sample.bin.openssl.sha256"
grep -E 'sample.bin|SHA256' "$LAB_DFIR/evidence/sample.bin.openssl.sha256"═══ WINDOWS ═══
YOUR lab Windows VM — hash YOUR sample copy
Command — copy this
Copy-Item $HOME/cyberlium-lab/t26-dfir/evidence/sample.bin $HOME/cyberlium-lab/t26-dfir/evidence/analysis/sample.bin Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/sample.bin -Algorithm SHA256 Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/analysis/sample.bin -Algorithm SHA256
Primary tools to practice this lesson: sha256sum, openssl, grep. Reference sites: OpenSSL dgst (https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); Sleuth Kit (https://www.sleuthkit.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for dd commands aimed at /dev/sd? without scope, 'ignore hash fail,' or stranger device IDs — remove. Pack stays literacy and safety.
Confirm notes reference $DFIR_LAB authority card from M1.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Disk and Filesystem.
Acquisition literacy feeds Autopsy and filesystem lessons in M4.
4. What you ship: acquisition literacy pack for $DFIR_LAB
Merged imaging, hash, blocker sections. $DFIR_LAB named. NO stranger hardware. chmod 600.
5. What you record before the next lesson
Date. Acquisition pack path. $DFIR_LAB named. File t26-m03-l04-acquisition-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live imaging commands against neighbor PC. Skip hash verify step.
Right
Write YOUR acquisition pack for $DFIR_LAB. chmod 600. Next: Quiz — Acquisition Literacy.
Mission: freeze YOUR acquisition pack
1) Merge M3 literacy sections. 2) Link CoC exhibit ID from M1. 3) Confirm zero stranger hardware references. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hash verify before Autopsy import saves rework.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Acquisition pack should cross-reference chain of custody.
True or False
Knowledge Check
APPLY: Write blockers in the pack are:
Multiple choice