Digital › Module 10 › Lesson 1
Checklist
Topic 26 capstone checklist — DFIR mindset, acquisition, analysis, timeline, reporting on $DFIR_LAB.
Visual · t26_capstone_checklist
Checklist consolidates DFIR literacy pillars. $DFIR_LAB only. Original Cyberlium.
Opening
Capstone proves DFIR literacy on YOUR authorized practice evidence — not a portfolio of stranger device dumps.
Assemble checklist covering Modules 1–9: DFIR mindset and CoC, evidence types, acquisition and hashing, disk/filesystem, memory, net/logs, timeline/correlation, reporting/legal, case practice. Use on capstone walk of YOUR $DFIR_LAB — never unauthorized acquisitions, planted evidence, or forged logs. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $DFIR_LAB only, legal authority stated, hashes verified, limitations documented, no tampering.
1. Scope and ethics
$DFIR_LAB named with authority reference. NEVER unauthorized device access, NEVER plant/tamper, NEVER forged logs.
Practice label when brief requires — honesty in capstone.
Command guide
Try these commands — Scope and ethics
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, python3. Reference sites: Capstone checklist (https://www.sans.org/cyber-security-skills/digital-forensics/); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
CoC, types, acquisition, disk, memory, net/logs, timeline, report, case — linked rows.
Cross-link Topic 25 AD literacy only as separate track — do not mix unauthorized AD dumps into DFIR pack.
3. Teardown
Notes secured chmod 600, report pack ready, lab snapshot revert optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 26 capstone checklist
One-page DFIR literacy capstone checklist for $DFIR_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'image roommate phone for bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger device imaging required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice