Digital › Module 9 › Lesson 1
Practice Datasets
Practice dataset literacy — public DFIR images, instructor synthetics, and $DFIR_LAB RoE before touching evidence.
Visual · t26_practice_datasets
Practice datasets = authorized learning sources. $DFIR_LAB. Original Cyberlium.
Opening
The right dataset with documented terms beats a stranger's leaked disk image every time.
Practice dataset literacy names acceptable sources: Cyberlium $DFIR_LAB images, public challenge images with documented terms (e.g., educational DFIR images with license noted), instructor synthetics, brief-assigned case files — each row documents download URL, UTC date, SHA256, terms acceptance, and storage path chmod 600. Refused: random torrent 'breach dumps,' employer prod clones without authorization, roommate device images, datasets with unknown provenance. Module 3 acquisition order applies before deep analysis. Lab row: dataset inventory card for your current practice case with hash verification proof.
1. Acceptable sources
$DFIR_LAB built images, instructor packs, licensed public practice images with terms row.
Document terms — some datasets forbid republishing artifacts.
Command guide
Try these commands — Acceptable sources
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, python3. Reference sites: NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); digitalcorpora.org (https://digitalcorpora.org/); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Inventory card
Source URL, SHA256, verified match, terms checkbox, analyst name, UTC download.
Re-hash before each major lab — Module 8 exhibit discipline.
3. Refused sources
Leaked enterprise disks, unauthorized acquisitions, unknown torrents — never course evidence.
If provenance unclear — stop and ask mentor.
4. What you ship: practice dataset inventory card
Source fields + terms row + hash verification + refused sources list.
5. What you record before the next lesson
Practice dataset inventory card path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Analyze leaked company disk image from forum as capstone evidence.
Right
Practice dataset inventory card for $DFIR_LAB. Next: Case Workflow.
Mission: practice dataset inventory card
1) List acceptable source types. 2) Write inventory card fields. 3) One verified dataset row. 4) List three refused source types.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Public image — minimum terms documentation?”
Knowledge Check
APPLY: Practice datasets require:
Multiple choice
Knowledge Check
APPLY: True or False: Leaked breach disks are lab sources.
True or False
Knowledge Check
APPLY: Dataset inventory includes:
Multiple choice