SOC › Module 6 › Lesson 3
Evidence Hygiene
Evidence hygiene literacy — chain of custody, hash, UTC, write-blocker category, lab notes — on $HUNT_LAB artifact stubs.
Visual · t30_evidence_hygiene
Evidence hygiene = named preservation rows. $HUNT_LAB. Original Cyberlium.
Opening
Bad evidence handling breaks cases — name chain-of-custody hygiene on YOUR lab artifact stubs before touching prod forensics without authorization.
Evidence hygiene literacy names: chain of custody (who handled what when UTC), cryptographic hash (SHA-256 category on lab file stub), write-blocker concept for disk imaging category, UTC timestamps on every touch, observed vs inferred in notes, and secure storage (chmod 600 lab pack). Analyst documents evidence row on $HUNT_LAB synthetic log export or instructor artifact stub — without imaging stranger laptops, without tampering hashes, without copying prod case evidence without RoE. Cyberlium teaches L2-depth hygiene at literacy level — NOT full forensic toolchain against unauthorized targets. Refused: unauthorized disk imaging, hash falsification, prod evidence exfiltration. Lab row: evidence card (source, hash stub, custodian, UTC chain) for one hunt artifact.
1. Evidence card fields
Source, acquisition UTC, hash, custodian, storage path — five literacy anchors.
Every handoff adds chain row — no anonymous copies.
Command guide
Try these commands — Evidence card fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence handling — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST evidence — https://www.first.org/resources/guides/ MITRE — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/evidence-hygiene.txt" <<'EOF'
EVIDENCE HYGIENE — LAB-IR-001 (YOUR lab only)
Collect:
- logs/auth.jsonl, process.jsonl, netflow.jsonl, alerts.json
- hunt/hunt-hypothesis.md, correlation-notes.md
- ir/picerl-checklist.md (chain of custody notes)
Handling:
- chmod 600 on sensitive lab files
- SHA256 hash log for integrity (lab literacy)
- Redact fictional PII in reports
NEVER: export unauthorized prod SIEM, run Mimikatz/Impacket for 'evidence'
EOFCommand — copy this
chmod 600 "$HUNT_LAB/ir/evidence-hygiene.txt" grep -E 'EVIDENCE|NEVER|chmod' "$HUNT_LAB/ir/evidence-hygiene.txt" sha256sum "$HUNT_LAB/logs/auth.jsonl" 2>/dev/null || shasum -a 256 "$HUNT_LAB/logs/auth.jsonl"
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence handling (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST evidence (https://www.first.org/resources/guides/); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender discipline
Redact PII in share-safe copies; label sample vs synthetic in $HUNT_LAB.
Integrity check before analysis — re-hash lab stub optional per brief.
3. Refused
No unauthorized imaging; no hash tampering; no prod evidence paste without RoE.
Evidence hygiene supports IR — not unauthorized collection.
4. What you ship: evidence hygiene card
Evidence card five fields + chain row + NEVER unauthorized imaging line.
5. What you record before the next lesson
Evidence hygiene card path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Image classmate laptop without authorization as 'forensics practice.'
Right
Evidence hygiene card from $HUNT_LAB artifact stub. Next: IR Lab.
Mission: evidence hygiene card
1) List five evidence card fields. 2) Add one chain-of-custody row UTC. 3) Label sample vs synthetic source. 4) Write NEVER unauthorized imaging line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hash stub — which algorithm literacy default?”
Knowledge Check
APPLY: Evidence hygiene on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Imaging stranger laptops without authorization is lab.
True or False
Knowledge Check
APPLY: Chain of custody records:
Multiple choice