Digital › Module 2 › Lesson 2
Disk Memory Net Logs
Disk, memory, network, and log artifacts name the four DFIR food groups — classify samples on YOUR $DFIR_LAB case map.
Visual · t26_disk_memory_net_logs
Evidence category literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Analysts triage by source — disk tells files, memory tells runtime, nets tell movement, logs tell policy events.
Disk artifacts: files, filesystem metadata, registry hives, prefetch, volume shadow copies. Memory artifacts: processes, DLLs, network sockets, credentials in RAM (handle carefully). Network artifacts: PCAP, firewall flows, DNS logs, proxy logs. Log artifacts: OS events, app logs, cloud audit trails — often the fastest defender signal. Cyberlium classifies four artifact types on YOUR $DFIR_LAB practice case — not exporting stranger tenant logs without authorization. Next: Metadata Named.
1. Disk and memory (named)
Disk: E01/aff images, file carving targets, MFT/USN journal literacy later. Memory: raw dump or VM snapshot RAM — Volatility-class tools read structure, not magic.
On $DFIR_LAB, tag one practice image as disk source and note if a companion memory dump exists in course materials.
Command guide
Try these commands — Disk and memory (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
file(1) magic — https://man7.org/linux/man-pages/man1/file.1.html (type identification literacy)
Sleuth Kit — https://www.sleuthkit.org/ (filesystem artifact context) digitalcorpora.org — https://digitalcorpora.org/ (corpus literacy — authorized datasets only)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in
macOS: Built-in
Windows: Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/evidence/sample.txt" <<'EOF'
LAB SAMPLE — not production evidence
Incident note: suspicious login attempt 2026-08-22T02:00:00Z
User: lab-analyst | Host: cyberlium-lab | Action: triage literacy
EOFCommand — copy this
file "$LAB_DFIR/evidence/sample.txt" grep -E 'LAB SAMPLE|suspicious' "$LAB_DFIR/evidence/sample.txt"
Primary tools to practice this lesson: file, grep. Reference sites: file(1) magic (https://man7.org/linux/man-pages/man1/file.1.html); Sleuth Kit (https://www.sleuthkit.org/); digitalcorpora.org (https://digitalcorpora.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Network and logs (named)
Network: PCAP from lab tap, Zeek/Suricata logs, NetFlow — movement and C2 patterns. Logs: Windows Event ID sequences, Linux auth.log, SaaS audit — correlate time in UTC.
Defenders often start with logs while imaging queues — your literacy names both lanes.
3. Case map hygiene
Forbidden: pulling employer SIEM exports without ticket scope. Allowed: four-quadrant case map — disk, memory, net, logs — with one example artifact per quadrant from $DFIR_LAB.
Ship: case map card with four quadrants and exhibit placeholders. Next: Metadata Named.
4. What you ship: disk/memory/net/logs case map for $DFIR_LAB
Four-quadrant map with one example each. $DFIR_LAB named. NO unauthorized log exports. chmod 600.
5. What you record before the next lesson
Date. Case map. $DFIR_LAB named. File t26-m02-l02-disk-memory-net-logs.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Export production SIEM without ticket. Skip log quadrant because 'disk is enough.'
Right
Write four-quadrant case map for YOUR $DFIR_LAB. Next: Metadata Named.
Mission: classify artifacts on YOUR case map
1) Name one disk artifact. 2) Name one memory or log artifact. 3) Name one network artifact. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Logs often give timeline anchors before deep disk carving.
Knowledge Check
APPLY: Disk artifacts primarily include:
Multiple choice
Knowledge Check
APPLY: True or False: Memory artifacts can reveal running processes and live connections.
True or False
Knowledge Check
APPLY: Log artifacts help defenders by:
Multiple choice