Digital › Module 4 › Lesson 4
Lab — Disk
Pack Autopsy flow, filesystem cues, and deleted recovery cards — disk literacy file from $DFIR_LAB only.
Visual · t26_disk_lab
Lab: disk pack. $DFIR_LAB only. Original Cyberlium.
Opening
Disk pack ties tool workflow to filesystem vocabulary — paperwork before memory module.
Lessons 4-1–4-3 named Autopsy workflow, filesystem cues, and deleted recovery. This lab merges three cards plus optional ingest module list for $DFIR_LAB practice image. No unauthorized imports — disk literacy paperwork acceptable. Next: Quiz — Disk and Filesystem.
1. Lab contract: disk pack
Create $HOME/cyberlium-lab/t26-m04-l04-disk-lab.txt merging Autopsy flow, filesystem cue, and recovery cards with exhibit ID and hash reference.
Optional: list two Autopsy ingest modules you would enable on practice image — keyword and recent activity literacy.
Command guide
Try these commands — Lab contract: disk pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Autopsy ingest — https://sleuthkit.org/autopsy/docs/user-docs/latest/ (authorized images only) digitalcorpora — https://digitalcorpora.org/corpora/files/ (practice file literacy) SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Use WSL or install binutils Use WSL or install file for Windows Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/notes/fake-log-lines.txt" <<'EOF'
2026-08-22T02:01:00Z sshd[1234]: Failed password for invalid user admin from 10.0.0.5
2026-08-22T02:01:05Z sshd[1234]: Failed password for invalid user root from 10.0.0.5
2026-08-22T02:01:10Z sudo: lab-analyst : TTY=pts/0 ; PWD=/home/lab ; USER=root ; COMMAND=/bin/ls
2026-08-22T02:01:15Z kernel: USB disconnect, device number 3
EOFCommand — copy this
file "$LAB_DFIR/notes/fake-log-lines.txt" strings "$LAB_DFIR/notes/fake-log-lines.txt" | grep -E 'sshd|sudo|kernel' | head -5 curl -sS https://www.autopsy.com/ | head -5
Primary tools to practice this lesson: strings, file, curl. Reference sites: Autopsy ingest (https://sleuthkit.org/autopsy/docs/user-docs/latest/); digitalcorpora (https://digitalcorpora.org/corpora/files/); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for planted evidence instructions, stranger image paths, or 'hide CoC' — remove. Pack stays tool literacy.
Confirm read-only source noted from M3 acquisition pack.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Memory Literacy.
Disk literacy feeds Volatility and order-of-volatility lessons in M5.
4. What you ship: disk literacy pack for $DFIR_LAB
Merged Autopsy, filesystem, recovery sections. $DFIR_LAB named. NO unauthorized imports. chmod 600.
5. What you record before the next lesson
Date. Disk pack path. $DFIR_LAB named. File t26-m04-l04-disk-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import unauthorized victim E01. Include planted-file tutorial.
Right
Write YOUR disk pack for $DFIR_LAB. chmod 600. Next: Quiz — Disk and Filesystem.
Mission: freeze YOUR disk pack
1) Merge M4 literacy sections. 2) Link exhibit ID and hash. 3) Confirm zero plant/tamper steps. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ingest module list prevents 'enable everything' slow cases.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Disk pack should tie to chain of custody exhibit ID.
True or False
Knowledge Check
APPLY: Autopsy in disk pack is:
Multiple choice