Digital › Module 2 › Lesson 3
Metadata Named
Metadata names data about data — timestamps, paths, hashes, EXIF — interpret on YOUR $DFIR_LAB exhibits without tampering.
Visual · t26_metadata_named
Metadata literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Files tell stories through metadata before you read a single paragraph of content.
Filesystem metadata: created/modified/accessed times (interpret with timezone and MACB rules), inode/MFT entry, parent path. File content metadata: EXIF in images, document author fields, PE headers. Cryptographic metadata: MD5/SHA-256 hashes proving integrity. Logs carry timestamps, user IDs, and source IP — all metadata for correlation. Cyberlium names metadata classes on YOUR $DFIR_LAB — document what each field means, never alter timestamps to 'fix' a timeline. Next: Types Lab.
1. Filesystem metadata (named)
MAC times: Modified, Accessed, Changed (inode/metadata change on Unix; MFT semantics on Windows — literacy not courtroom testimony here). $STANDARD_INFORMATION vs $FILE_NAME on NTFS is advanced — know timestamps can disagree.
On $DFIR_LAB, pick one file from a practice image listing and record three metadata fields — from tool output or course screenshot.
Command guide
Try these commands — Filesystem metadata (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence classification — https://www.sans.org/cyber-security-skills/digital-forensics/ NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds Autopsy — https://www.autopsy.com/ (artifact categories in GUI literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/notes/evidence-classification.txt" <<'EOF'
volatile: RAM, ARP cache, running processes — collect first on YOUR machine only
non-volatile: disk files, logs, pcap — hash before analysis
lab sample.txt: non-volatile text artifact — YOUR creation
never: classify stranger production drives without written RoE
EOFCommand — copy this
grep -E 'volatile|non-volatile|never' "$LAB_DFIR/notes/evidence-classification.txt"
python3 -c "print('Classify YOUR lab artifacts — document type before deep analysis')"Primary tools to practice this lesson: grep, python3. Reference sites: Evidence classification (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); Autopsy (https://www.autopsy.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Hash and exhibit metadata
Hashes are integrity metadata — tie exhibit ID to SHA-256 at intake and after each verified copy. Document tool version that produced the hash line.
Changing a single bit changes the hash — that is the point. Never edit originals to 'clean up' metadata.
3. Anti-tamper literacy
Forbidden: timestomping practice files to match a fake story, stripping EXIF to hide origin without documenting, or planting files then claiming 'discovery.' Allowed: metadata glossary with defender interpretation notes.
Ship: metadata glossary — five terms with one-line meaning each. Next: Types Lab.
4. What you ship: metadata glossary for $DFIR_LAB
Five metadata terms with definitions. $DFIR_LAB named. NEVER tamper with timestamps. chmod 600.
5. What you record before the next lesson
Date. Metadata glossary. $DFIR_LAB named. File t26-m02-l03-metadata-named.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Timestomp lab files for a 'cooler' timeline. Delete hash lines to save space.
Right
Write metadata glossary for YOUR $DFIR_LAB work. Next: Types Lab.
Mission: name metadata on YOUR exhibit
1) Define MAC times in one line. 2) Define SHA-256 role in CoC. 3) List two non-filesystem metadata examples. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
UTC + documented timezone beats arguing local offsets later.
Knowledge Check
APPLY: Metadata literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Hashes are integrity metadata tied to chain of custody.
True or False
Knowledge Check
APPLY: Timestomping practice evidence is:
Multiple choice