Digital › Module 1 › Lesson 4
Lab — CoC Form
Pack DFIR scope, CoC template, and legal authority — custody pack file only, dest $DFIR_LAB.
Visual · t26_coc_lab
Lab: write CoC pack. $DFIR_LAB only. Original Cyberlium.
Opening
CoC pack before any Autopsy import — paperwork discipline DFIR mentors expect.
Lessons 1–3 defined what DFIR is, chain of custody fields, and legal authority. This lab ships the combined artifact: literacy definition, CoC template row, and authority card for $DFIR_LAB. No imaging execution required — scope and custody paperwork first. Next: Quiz — DFIR Mindset and CoC.
1. Lab contract: write the CoC pack
Create $HOME/cyberlium-lab/t26-m01-l04-coc-lab.txt with date, operator, $DFIR_LAB case placeholder, literacy vs unauthorized imaging paragraph, CoC template row, and authority card.
Optional: one-line proof your practice image exists — still no stranger-device imaging required in this lab.
Command guide
Try these commands — Lab contract: write the CoC pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Chain of custody — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds (NIST practice mindset) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (collection documentation) CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/evidence/coc-form.txt" <<'EOF'
CHAIN OF CUSTODY — LAB CASE T26-001
Case ID: T26-LAB-001
Examiner: (your name)
Date/Time acquired: (ISO8601 UTC)
Source: YOUR machine — $HOME/cyberlium-lab/t26-dfir/evidence/
Description: empty evidence bag note — lab literacy only
Hash algorithm: SHA-256
Hash value: (compute below)
EOFCommand — copy this
touch "$LAB_DFIR/evidence/case-bag-note.txt" sha256sum "$LAB_DFIR/evidence/case-bag-note.txt" | tee "$LAB_DFIR/evidence/case-bag-note.sha256" grep -E 'Case ID|SHA-256|Hash value' "$LAB_DFIR/evidence/coc-form.txt"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only — hash YOUR lab note file
Command — copy this
New-Item -ItemType File -Force -Path $HOME/cyberlium-lab/t26-dfir/evidence/case-bag-note.txt | Out-Null Get-FileHash $HOME/cyberlium-lab/t26-dfir/evidence/case-bag-note.txt -Algorithm SHA256 Get-Content $HOME/cyberlium-lab/t26-dfir/evidence/coc-form.txt | Select-String 'Case ID|Hash'
Primary tools to practice this lesson: sha256sum, grep. Reference sites: Chain of custody (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'image neighbor,' tamper, skip custody, or live victim filenames — redact or delete. Rewrite forum habits to $DFIR_LAB placeholders before you copy workflows.
Classmates build their own CoC packs for their $DFIR_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Evidence Types.
DFIR mentors archive CoC before first tool import; you are practicing that habit early.
4. What you ship: DFIR CoC pack for $DFIR_LAB
CoC pack: scope, custody row, authority card. $DFIR_LAB named. NEVER stranger devices. chmod 600.
5. What you record before the next lesson
Date. CoC pack path. $DFIR_LAB scope note. File t26-m01-l04-coc-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and open Autopsy on unknown media. Add stranger device to approved list.
Right
Write YOUR CoC pack for $DFIR_LAB. chmod 600. Next: Quiz — DFIR Mindset and CoC.
Mission: freeze YOUR CoC pack on disk
1) Merge scope, CoC, authority sections. 2) Name $DFIR_LAB. 3) chmod 600. Never list stranger-device imaging as approved practice.
Stuck? Ask Cyberlium AI Mentor
CoC packs are boring on purpose — boring keeps evidence defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on DFIR lab notes.
True or False
Knowledge Check
APPLY: A tutorial images a live phone without consent. You:
Multiple choice