Digital › Module 9 › Lesson 3
Common Pitfalls
Common DFIR pitfalls literacy — scope creep, tool worship, confirmation bias, spoliation on $DFIR_LAB cases.
Visual · t26_common_pitfalls
Pitfalls = named mistakes to avoid. $DFIR_LAB. Original Cyberlium.
Opening
The case you lose is usually the one where you skipped hash verification or chased a sexy hypothesis.
Pitfall literacy names: scope creep (analyze systems outside RoE), skipping hash verification, mixing UTC/local silently, confirmation bias (delete contradicting rows), tool worship (report tool output without source citation), single-artifact certainty, unauthorized acquisition, planting/tampering, report without limitations, live malware interaction on host OS. Each pitfall row: name, symptom, fix, module link. Cyberlium on $DFIR_LAB — use pitfalls checklist during case lab and capstone. Refused: treating pitfalls list as 'how to hide mistakes.' Lab: pick five pitfalls you almost made in Modules 6–8 and document fix applied.
1. Top pitfalls
Scope creep, hash skip, UTC mix, confirmation bias, no limitations section — five minimum named.
Link each to Module 1 CoC or Module 8 ethics where applicable.
Command guide
Try these commands — Top pitfalls
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
digitalcorpora about — https://digitalcorpora.org/about/ (corpus provenance literacy) NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/notes/practice-dataset-plan.txt" <<'EOF'
practice dataset literacy plan:
1. Read NIST CFReDS + digitalcorpora about pages (curl above)
2. Download ONLY authorized CFReDS/corpora for YOUR lab VM
3. Hash downloaded image before Autopsy ingest
4. NEVER: random disk images from untrusted sources
EOFCommand — copy this
grep -E 'authorized|NEVER|Hash' "$LAB_DFIR/notes/practice-dataset-plan.txt" curl -sS https://digitalcorpora.org/about/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: digitalcorpora about (https://digitalcorpora.org/about/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Symptom and fix
Symptom: 'timeline feels thin' — fix: gap paragraph not fabrication.
Symptom: 'tool said guilty' — fix: cite exhibit and observed row.
3. Refused
Pitfalls doc is not evasion guide — fixes increase integrity, not hide errors.
No pitfall excuses unauthorized access.
4. What you ship: pitfalls checklist
Ten named pitfalls + symptom/fix columns + five personal near-miss rows from lab.
5. What you record before the next lesson
Pitfalls checklist path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use pitfalls list to justify deleting exculpatory log rows.
Right
Pitfalls checklist with fixes applied on $DFIR_LAB. Next: Case Lab.
Mission: pitfalls checklist
1) Name ten DFIR pitfalls. 2) Symptom and fix per pitfall. 3) Five personal near-miss rows. 4) Link each fix to a module lesson.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Confirmation bias — peer review stub?”
Knowledge Check
APPLY: Confirmation bias fix:
Multiple choice
Knowledge Check
APPLY: True or False: Tool output alone is sufficient finding.
True or False
Knowledge Check
APPLY: Scope creep means:
Multiple choice