Digital › Module 9 › Lesson 2
Case Workflow
Case workflow literacy — intake, preservation, analysis, reporting, handoff on $DFIR_LAB practice cases.
Visual · t26_case_workflow
Case workflow = intake to handoff stations. $DFIR_LAB. Original Cyberlium.
Opening
Walk the case stations in order — skip preservation and your timeline is inadmissible before you finish the lab.
Case workflow literacy maps stations: (1) intake and scope/authority check, (2) preservation and hashing, (3) acquisition per Module 3 order, (4) analysis branches (disk Module 4, memory Module 5, net/logs Module 6, timeline Module 7), (5) reporting Module 8, (6) handoff and archive with chmod 600 and retention note. UTC milestones and artifact ID per station. Cyberlium workflow on $DFIR_LAB practice — NOT skipping CoC because 'it's just lab,' NOT handoff without exhibit table, NOT analysis before hash verification. Output: workflow diagram with six stations and ethics gate at intake.
1. Six stations
Intake → preserve → acquire → analyze → report → handoff — no station skip.
Ethics gate at intake: authority documented or STOP.
Command guide
Try these commands — Six stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST Hacking Case — https://www.nist.gov/itl/ssd/software-quality-group/hacking-case-0 (CFReDS scenario literacy) digitalcorpora files — https://digitalcorpora.org/corpora/files/ (M57-Patents etc.) Sleuth Kit — https://www.sleuthkit.org/ (tools for authorized corpora)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
curl -sS https://www.nist.gov/itl/ssd/software-quality-group/hacking-case-0 | head -8
curl -sS https://digitalcorpora.org/corpora/files/ | head -8
grep -E 'NEVER|authorized|stranger' "$LAB_DFIR/notes/no-stranger-evidence.txt"Primary tools to practice this lesson: curl, grep. Reference sites: NIST Hacking Case (https://www.nist.gov/itl/ssd/software-quality-group/hacking-case-0); digitalcorpora files (https://digitalcorpora.org/corpora/files/); Sleuth Kit (https://www.sleuthkit.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Parallel analysis
Disk, memory, net/logs may run parallel after acquisition — timeline merges at Module 7.
Each branch logs tool version and exhibit ID.
3. Handoff
Mentor pack: report + exhibits + index — share-safe redaction optional.
Archive retention per brief; secure delete of temp mounts.
4. What you ship: case workflow diagram
Six stations + ethics gate + UTC milestone column + link to Module 8 report.
5. What you record before the next lesson
Case workflow diagram path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Start analysis before hashing because practice case 'doesn't count.'
Right
Case workflow diagram for $DFIR_LAB. Next: Common Pitfalls.
Mission: case workflow diagram
1) Name six stations. 2) Ethics gate at intake. 3) UTC milestone per station. 4) Link final station to report lab.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Parallel analysis — document how?”
Knowledge Check
APPLY: Case workflow starts with:
Multiple choice
Knowledge Check
APPLY: True or False: Skip hashing in practice cases.
True or False
Knowledge Check
APPLY: Handoff includes:
Multiple choice