Digital › Module 1 › Lesson 1
What DFIR Is
Digital forensics literacy means naming identification, preservation, analysis, and reporting on YOUR $DFIR_LAB evidence — not imaging stranger devices.
Visual · t26_what_dfir_is
DFIR scope literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Every breach response eventually touches artifacts — Cyberlium teaches DFIR vocabulary and integrity habits, not unauthorized imaging cookbooks.
Digital Forensics and Incident Response (DFIR) is the disciplined practice of finding, preserving, analyzing, and explaining digital evidence from computers, phones, networks, and logs. Analysts need this vocabulary to support investigations, legal review, and defender reporting — not to clone neighbor laptops without authority. Cyberlium Topic 26 teaches on $DFIR_LAB — YOUR practice disk images, authorized case files, course datasets, or lab VMs you own or enrolled in with written scope. You will name evidence classes, chain of custody, and acquisition literacy — never step-by-step imaging of stranger phones or PCs. Next: Chain of Custody.
1. What DFIR covers (named)
DFIR spans identification (what exists), preservation (protect integrity), collection (legal acquisition), examination (tool-assisted review), analysis (what happened), and reporting (explain findings). One mishandled artifact can taint an entire case — defenders prioritize documentation and hashes early.
Literacy means you can name volatile vs persistent evidence, chain of custody fields, and imaging concepts when reading a report — not that you can image a device you do not own or lack legal authority to touch.
Command guide
Try these commands — What DFIR covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/ (DFIR discipline overview) CISA incident response — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response (responder context) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (evidence collection order) NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds (practice datasets literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('DFIR literacy: preserve, document, analyze YOUR lab artifacts only')"
curl -sS https://www.sans.org/cyber-security-skills/digital-forensics/ | head -8
curl -sS https://www.rfc-editor.org/rfc/rfc3227 | head -10Primary tools to practice this lesson: python3, curl. Reference sites: SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/); CISA incident response (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Who needs DFIR vocabulary
Incident responders triage hosts and preserve order-of-volatility inside authorized scope. SOC analysts correlate disk, memory, and log artifacts. Legal and compliance teams review custody and authority before exhibits ship to court or regulators.
Cyberlium assumes YOU practice on $DFIR_LAB — practice images you created, course E01/VM snapshots, or authorized case media with explicit rules — not employer production without scope or random devices from the internet.
3. What this topic will never call practice
Imaging stranger phones or PCs without legal authority, planting or tampering with evidence, skipping chain of custody to 'move faster,' sharing live victim disk images in chat, or running Autopsy/Volatility playbooks against unauthorized targets.
Ship a sentence: Topic 26 here means DFIR literacy and integrity on MY $DFIR_LAB practice evidence for learning and authorized response. Next lesson: Chain of Custody.
4. What you ship: DFIR topic scope scoped to $DFIR_LAB literacy
Write literacy vs unauthorized imaging in one paragraph. Dest = $DFIR_LAB practice evidence. NEVER stranger devices. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Topic scope. Lab = $DFIR_LAB. NEVER stranger imaging or evidence tampering. Path: $HOME/cyberlium-lab/t26-m01-l01-what-dfir-is.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Image a classmate's laptop without permission. Treat Topic 26 as a free pass to clone any USB drive you find.
Right
Define DFIR literacy and name $DFIR_LAB as the only practice surface. Next: Chain of Custody.
Mission: define Topic 26 for YOUR lab evidence
1) Write literacy vs unauthorized imaging in one paragraph each. 2) Write a NEVER list (stranger devices, tampering, skipping CoC). 3) Name $DFIR_LAB as your placeholder. Never image hardware outside your scoped lab media.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what does DFIR mean to defenders?' — not how to image a neighbor's phone.
Knowledge Check
APPLY: DFIR on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 26 includes imaging stranger PCs without legal authority.
True or False
Knowledge Check
APPLY: Primary output of this topic supports:
Multiple choice