Digital › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 26 literacy evidence from $DFIR_LAB — case lab, report, timeline, exhibits; no tampering.
Visual · t26_evidence_pack
Evidence pack = mentor handoff from $DFIR_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered PCAP notes — and never includes a forged log or unauthorized disk image.
Assemble evidence pack: $DFIR_LAB RoE/authority, dataset inventory, net/logs lab, timeline lab, report lab, case lab handoff, integrity statement (authorized practice only, hashes verified, no tampering, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + exhibit table, not live malware on USB. Gap paragraph for Topic 27 Mobile Security — separate authorized track. Scan folder for leaked dumps, planted metadata, unauthorized paths — zero tolerance.
1. Pack contents
Minimum: authority, inventory, net/logs, timeline, report, case index, integrity.
Optional: pitfalls checklist — no refused source artifacts.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Timeline capstone — https://www.sans.org/cyber-security-skills/digital-forensics/ Autopsy timeline — https://www.autopsy.com/ CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
grep '2026-08-22' "$LAB_DFIR/notes/timeline.csv" | tee "$LAB_DFIR/report/capstone-timeline-extract.txt"
grep -f <(cut -d, -f4 "$LAB_DFIR/notes/timeline.csv" | tail -n +2 | sed 's|.*/||') "$LAB_DFIR/notes/fake-log-lines.txt" 2>/dev/null || grep Failed "$LAB_DFIR/notes/fake-log-lines.txt"
python3 -c "print('Timeline correlated with log lines — capstone literacy')"Primary tools to practice this lesson: grep, python3. Reference sites: Timeline capstone (https://www.sans.org/cyber-security-skills/digital-forensics/); Autopsy timeline (https://www.autopsy.com/); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$DFIR_LAB only, legal reporting discipline, no tampering, share-safe export.
Scan before seal — remove accidental temp mounts or unhashed exports.
4. What you ship: DFIR literacy evidence pack
Bundled deliverables + index + integrity — chmod 600, report not tampering default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes leaked disk and forged Event logs.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle case report timeline inventory index. 2) Integrity statements. 3) Confirm zero refused source files. 4) Gap note for Topic 27 Mobile Security.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Tampered evidence OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice