Digital › Module 4 › Lesson 4
Lab — Disk
Pack Autopsy flow, filesystem cues, and deleted recovery cards — disk literacy file from $DFIR_LAB only.
Visual · t26_disk_lab
Lab: disk pack. $DFIR_LAB only. Original Cyberlium.
Opening
Disk pack ties tool workflow to filesystem vocabulary — paperwork before memory module.
Lessons 4-1–4-3 named Autopsy workflow, filesystem cues, and deleted recovery. This lab merges three cards plus optional ingest module list for $DFIR_LAB practice image. No unauthorized imports — disk literacy paperwork acceptable. Next: Quiz — Disk and Filesystem.
1. Lab contract: disk pack
Create $HOME/cyberlium-lab/t26-m04-l04-disk-lab.txt merging Autopsy flow, filesystem cue, and recovery cards with exhibit ID and hash reference.
Optional: list two Autopsy ingest modules you would enable on practice image — keyword and recent activity literacy.
Command guide
Try these commands — Lab contract: disk pack
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: strings, file, curl. Reference sites: Autopsy ingest (https://sleuthkit.org/autopsy/docs/user-docs/latest/); digitalcorpora (https://digitalcorpora.org/corpora/files/); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for planted evidence instructions, stranger image paths, or 'hide CoC' — remove. Pack stays tool literacy.
Confirm read-only source noted from M3 acquisition pack.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Memory Literacy.
Disk literacy feeds Volatility and order-of-volatility lessons in M5.
4. What you ship: disk literacy pack for $DFIR_LAB
Merged Autopsy, filesystem, recovery sections. $DFIR_LAB named. NO unauthorized imports. chmod 600.
5. What you record before the next lesson
Date. Disk pack path. $DFIR_LAB named. File t26-m04-l04-disk-lab.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import unauthorized victim E01. Include planted-file tutorial.
Right
Write YOUR disk pack for $DFIR_LAB. chmod 600. Next: Quiz — Disk and Filesystem.
Mission: freeze YOUR disk pack
1) Merge M4 literacy sections. 2) Link exhibit ID and hash. 3) Confirm zero plant/tamper steps. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ingest module list prevents 'enable everything' slow cases.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Disk pack should tie to chain of custody exhibit ID.
True or False
Knowledge Check
APPLY: Autopsy in disk pack is:
Multiple choice