Digital › Module 10 › Lesson 1
Checklist
Topic 26 capstone checklist — DFIR mindset, acquisition, analysis, timeline, reporting on $DFIR_LAB.
Visual · t26_capstone_checklist
Checklist consolidates DFIR literacy pillars. $DFIR_LAB only. Original Cyberlium.
Opening
Capstone proves DFIR literacy on YOUR authorized practice evidence — not a portfolio of stranger device dumps.
Assemble checklist covering Modules 1–9: DFIR mindset and CoC, evidence types, acquisition and hashing, disk/filesystem, memory, net/logs, timeline/correlation, reporting/legal, case practice. Use on capstone walk of YOUR $DFIR_LAB — never unauthorized acquisitions, planted evidence, or forged logs. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $DFIR_LAB only, legal authority stated, hashes verified, limitations documented, no tampering.
1. Scope and ethics
$DFIR_LAB named with authority reference. NEVER unauthorized device access, NEVER plant/tamper, NEVER forged logs.
Practice label when brief requires — honesty in capstone.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Capstone checklist — https://www.sans.org/cyber-security-skills/digital-forensics/ NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + evidence/ notes/ pcap/ report/ dirs
[ ] CoC form + case-bag-note hashed
[ ] sample.txt + sample.bin created and hashed twice
[ ] write-blocker policy documented
[ ] strings/file/xxd on YOUR samples
[ ] Autopsy + Volatility docs curled; ps aux literacy
[ ] tcpdump -c on lo + journalctl/fake logs + exiftool/strings on tiny jpeg
[ ] timeline.csv correlated with grep
[ ] report template + exhibit hash list
[ ] never: stranger disks / production RAM dumps
EOFCommand — copy this
grep '\[ \]' "$LAB_DFIR/notes/capstone-checklist.txt"
python3 -c "print('Capstone: DFIR literacy — YOUR lab artifacts only')"Primary tools to practice this lesson: grep, python3. Reference sites: Capstone checklist (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
CoC, types, acquisition, disk, memory, net/logs, timeline, report, case — linked rows.
Cross-link Topic 25 AD literacy only as separate track — do not mix unauthorized AD dumps into DFIR pack.
3. Teardown
Notes secured chmod 600, report pack ready, lab snapshot revert optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 26 capstone checklist
One-page DFIR literacy capstone checklist for $DFIR_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'image roommate phone for bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger device imaging required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice