Digital › Module 8 › Lesson 2
Exhibits Hashes
Exhibit and hash literacy — SHA256 inventory, exhibit IDs, and integrity statements for $DFIR_LAB report packs.
Visual · t26_exhibits_hashes
Exhibits + hashes = integrity inventory. $DFIR_LAB. Original Cyberlium.
Opening
Every exhibit gets an ID and a hash — or your report fails the first cross-examination question.
Exhibit literacy: assign Exhibit A/B/C or E-001 series to disk images, PCAP exports, log archives, memory dumps, screenshots — each row lists filename, SHA256, acquisition UTC, tool, custodian, storage path on $DFIR_LAB. Hash verification row: re-hash before analysis and note match/mismatch. Module 3 hashing integrity carries forward. Cyberlium teaches exhibit tables for practice reports — NOT reusing hashes from internet without verification, NOT omitting hash when attaching file, NOT altering exhibit after hash recorded. Share-safe export lists exhibit ID and redacted description — full paths chmod 600 mentor pack only.
1. Exhibit table fields
Exhibit ID, description, SHA256, size, acquired UTC, tool, custodian, verification status.
Screenshots are exhibits too — hash PNG export when brief requires.
Command guide
Try these commands — Exhibit table fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Exhibit hashing — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds NIST integrity — hash all exhibits before report finalization SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
cat > "$LAB_DFIR/report/exhibit-hashes.txt" <<'EOF'
EXHIBIT HASH LIST — T26-LAB-001
Exhibit A: evidence/sample.txt
Exhibit B: evidence/sample.bin
Exhibit C: notes/fake-log-lines.txt
Exhibit D: pcap/lo-lab.pcap
Algorithm: SHA-256
EOFCommand — copy this
sha256sum "$LAB_DFIR/evidence/sample.txt" "$LAB_DFIR/evidence/sample.bin" "$LAB_DFIR/notes/fake-log-lines.txt" 2>/dev/null | tee -a "$LAB_DFIR/report/exhibit-hashes.txt" grep -E 'Exhibit|sample|fake-log' "$LAB_DFIR/report/exhibit-hashes.txt" | head -10
Primary tools to practice this lesson: sha256sum, grep. Reference sites: Exhibit hashing (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); NIST integrity; SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verification workflow
Hash on acquisition and hash before analysis session — document both in CoC chain.
Mismatch stops analysis until supervisor/brief resolution — do not silently continue.
3. Refused
No exhibit without hash; no post-hash edits without new exhibit version row.
No stranger device images without legal authority in inventory.
4. What you ship: exhibit hash table template
Eight column exhibit table + verification workflow + mismatch stop rule.
5. What you record before the next lesson
Exhibit hash table template path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Change PCAP file after recording SHA256 without new exhibit entry.
Right
Exhibit hash table for $DFIR_LAB report. Next: Legal Ethics.
Mission: exhibit hash table template
1) List eight exhibit columns. 2) Write verification workflow. 3) Three exhibit rows from prior labs. 4) Write mismatch stop rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Screenshot exhibit — hash PNG?”
Knowledge Check
APPLY: Exhibit table includes:
Multiple choice
Knowledge Check
APPLY: True or False: Edit file after hash without new exhibit version.
True or False
Knowledge Check
APPLY: Hash mismatch should:
Multiple choice