Forensics challenges: what happened?
From disk images, memory dumps, logs and captures you work out when, how and by whom an incident happened.
Level 301 · 14 lessons · 12 practice labs
Lessons
Disk and files
- Recover a deleted document
- Catch altered timestamps
- A second payload hidden inside a file
- Traces of a plugged-in USB stick
- Short task: hash the disk image and write a chain-of-custody note
Memory and processes
- A suspicious process in a memory dump
- Open connections in memory
- The commands the attacker ran
- Short task: draw the suspicious process's parent tree
Logs and timeline
- The first logon from Windows logon events
- The successful attempt in a Linux auth log
- A backdoor request in a web log
- Merge all sources into one timeline
- Capstone: tell the story of a data leak end to end with evidence
Practice labs
- Identify the real type of files with changed extensions: You determine the real type of the files in an evidence folder from their content and write the list of mismatched extensions to the result file.
- Prove from metadata who prepared a document: You extract the author, last editor and edit dates of a disputed proposal at Pusulam Sigorta from its metadata and write them to the result file.
- Recover photos from a formatted memory card: You recover deleted pictures from a formatted card image and submit the flag visible in one of them.
- List the files a user opened most recently: From the traces in a user profile you find the five most recently opened files in time order and write them to the result file.
- Find where a downloaded file came from in browser traces: From browser records you extract the source address and download time of a file that landed on an Erguvan Eczanesi computer and submit them in flag format.
- List the files copied into a sync folder: In a disk image you determine the files moved into a cloud sync folder, their times and sizes and write the evidence listing to the result file.
- Establish a memory dump's identity: From a memory dump you determine the operating system version, uptime and logged-in user and write them to the result file.
- Find the kernel module missing from the baseline: You compare the modules loaded in memory with the approved baseline and submit the name of the one not on the list as the flag.
- Read a suspicious process's settings from memory: You recover a suspicious process's configuration and the address it contacts from the text in its memory region and write the findings to the result file.
- Find the silent gap in a log: In a system log that normally records steadily you find the start and end of the span where entries were removed and submit them in flag format.
- Show from the logs who changed a configuration: On a Lalezar Tekstil server you match privileged command records with file change times and write the account and time of the change to the result file.
- Merge three sources in different time zones into one timeline: You convert server, firewall and application logs kept in different time zones to a common time and write the timeline showing the true order of events to the result file.
About this course
From disk images, memory dumps, logs and captures you work out when, how and by whom an incident happened.
What you will learn
- Disk and files
- Memory and processes
- Logs and timeline
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.