Digital › Module 2 › Lesson 4
Lab — Types
Pack volatile/persistent, disk/memory/net/logs map, and metadata glossary — evidence types file from $DFIR_LAB only.
Visual · t26_types_lab
Lab: evidence types pack. $DFIR_LAB only. Original Cyberlium.
Opening
Evidence types pack ties volatility to artifact classes — paperwork before acquisition module.
Lessons 2-1–2-3 named volatile vs persistent, four artifact quadrants, and metadata. This lab merges volatility table, case map, and metadata glossary into one $DFIR_LAB evidence types artifact. No stranger-device collection — classification paperwork only. Next: Quiz — Evidence Types.
1. Lab contract: evidence types pack
Create $HOME/cyberlium-lab/t26-m02-l04-types-lab.txt merging volatility table, four-quadrant map, and metadata glossary with $DFIR_LAB case name and date.
Optional: screenshot of file listing from YOUR practice image — redact any out-of-scope paths.
Command guide
Try these commands — Lab contract: evidence types pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
file magic — https://man7.org/linux/man-pages/man1/file.1.html
digitalcorpora — https://digitalcorpora.org/corpora/ (authorized corpus literacy) Sleuth Kit — https://www.sleuthkit.org/sleuthkit/docs.php
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (binutils)
macOS: Built-in
Windows: Use WSL or install file for Windows Use WSL or install binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/notes/photo-copy-notes.txt" <<'EOF'
photo copy notes (lab literacy — not a real crime scene):
- wide shot: workstation with labeled evidence bag
- close-up: case ID tag T26-LAB-001 on YOUR sample media
- scale: USB label next to sample.txt printout
document before touching — YOUR lab staging area only
EOFCommand — copy this
file "$LAB_DFIR/evidence/sample.txt" "$LAB_DFIR/notes/photo-copy-notes.txt" strings "$LAB_DFIR/evidence/sample.txt" | head -5 grep -E 'case ID|document before' "$LAB_DFIR/notes/photo-copy-notes.txt"
═══ WINDOWS ═══
YOUR lab Windows VM — classify YOUR sample file
Command — copy this
Get-Content $HOME/cyberlium-lab/t26-dfir/evidence/sample.txt | Select-String 'LAB SAMPLE' Write-Output 'Document file type + hash before analysis — lab literacy only'
Primary tools to practice this lesson: file, strings. Reference sites: file magic (https://man7.org/linux/man-pages/man1/file.1.html); digitalcorpora (https://digitalcorpora.org/corpora/); Sleuth Kit (https://www.sleuthkit.org/sleuthkit/docs.php). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal boundaries
Grep pack for production hostnames, victim PII, tamper instructions — redact or delete. Types pack stays documentary.
Update map if you swap practice images — note new hash in CoC cross-reference.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Acquisition Literacy.
Evidence typing feeds imaging and hashing lessons in M3.
4. What you ship: evidence types pack for $DFIR_LAB
Merged volatility, quadrant map, metadata sections. $DFIR_LAB named. NO stranger exports. chmod 600.
5. What you record before the next lesson
Date. Types pack path. $DFIR_LAB named. File t26-m02-l04-types-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include production SIEM export in pack. Skip metadata glossary.
Right
Write YOUR evidence types pack for $DFIR_LAB. chmod 600. Next: Quiz — Evidence Types.
Mission: freeze YOUR evidence types pack
1) Merge M2 literacy sections. 2) Confirm zero production/victim PII. 3) Note practice image hash reference. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One page of typed evidence beats ten unauthorized collections.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Evidence types pack should reference $DFIR_LAB scope.
True or False
Knowledge Check
APPLY: Evidence types pack should include:
Multiple choice