Digital › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $DFIR_LAB — checklist, lab path, evidence pack sealed; zero tampering.
Visual · t26_capstone_lab
Capstone: checklist × $DFIR_LAB literacy evidence. Original Cyberlium.
Opening
Close the DFIR literacy loop — case walked, report shipped, exhibits hashed — without unauthorized access or planted artifacts.
Walk Topic 26 checklist on YOUR $DFIR_LAB: verify authority, lab path current, case lab complete, report with exhibits and ethics block, timeline with honest gaps, evidence pack indexed, scan for tampering and refused sources (must be zero). Update index with capstone UTC completion. Integrity paragraph: legal reporting discipline key insight from YOUR path. No unauthorized imaging, no forged logs, no planted metadata. Optional mentor review — three clarity questions. Revert lab snapshot after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for leaked dumps and forged logs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
DFIR capstone — https://www.sans.org/cyber-security-skills/digital-forensics/ NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Use WSL or install binutils Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
grep NEVER "$LAB_DFIR/notes/no-stranger-evidence.txt"
sha256sum -c "$LAB_DFIR/evidence/sample.bin.sha256" 2>/dev/null
strings "$LAB_DFIR/evidence/sample.bin" | head -3
grep auth_failure "$LAB_DFIR/notes/timeline.csv"
python3 - <<'PY'
import os
lab = os.environ.get('LAB_DFIR', os.path.expanduser('~/cyberlium-lab/t26-dfir'))
report = os.path.join(lab, 'report', 'capstone-summary.txt')
open(report, 'w').write(
'DFIR Literacy Capstone
'
'scope: YOUR $HOME/cyberlium-lab/t26-dfir/ only
'
'integrity: sample.bin SHA-256 verified
'
'analysis: strings + file + timeline + lo pcap
'
'report: template + exhibit hashes + findings draft
'
'never: stranger disk images / production RAM dumps
')
print(f'Wrote {report}')
PYCommand — copy this
grep -E 'scope|integrity|never' "$LAB_DFIR/report/capstone-summary.txt" chmod 600 "$LAB_DFIR/report/"*.txt 2>/dev/null || true
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/sample.bin -Algorithm SHA256 Get-Content $HOME/cyberlium-lab/t26-dfir/notes/timeline.csv | Select-String 'auth_failure' Get-Content $HOME/cyberlium-lab/t26-dfir/notes/no-stranger-evidence.txt | Select-String NEVER
Primary tools to practice this lesson: sha256sum, strings, grep, python3. Reference sites: DFIR capstone (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
Legal authority + hash discipline key → professional handoff idea from YOUR lab path.
Name what breaks if you skip CoC or tamper — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 27 Mobile Security on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero tampering scan.
5. What you record before the next lesson
Capstone pack path. $DFIR_LAB quiet.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes unauthorized laptop image as bonus exhibit.
Right
Capstone complete on $DFIR_LAB with full teardown. Next: topic quiz.
Mission: Topic 26 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero tampering files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Planted evidence earns capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice