Forensics practice arena
In unguided tasks mixing disk, memory, log and document evidence you test your speed and accuracy, documenting each solution in a short findings note.
Level 301 · 15 lessons · 12 practice labs
Lessons
Disk tasks
- A file hidden in an NTFS alternate stream
- A deleted key file on ext4
- Which USB stick, which file, what time
- Short task: find a container’s password from the evidence
Memory tasks
- The process missing from the list
- The command-server address in memory
- Command lines and clipboard left in memory
- Short task: find persistence from the difference between two dumps
Log and document tasks
- Lateral movement in the event log
- The macro’s hidden download URL
- Catch the timestomped file
- Short task: find evidence elsewhere for a cleared log
Mixed tasks
- One question that needs disk, memory and logs
- Timed round: five findings in 30 minutes
- Capstone: solve an incident pack and write the findings note
Practice labs
- A file hidden in an alternate stream: Find the hidden stream in an NTFS image and read the flag inside.
- A deleted key file on ext4: Recover the deleted key file from the journal and extract the flag.
- Which USB, which file, what time: Build the flag by finding the device serial, file name and time from registry and shortcut traces.
- The command line left in memory: Find the flag hidden in the process command lines of a dump.
- The process hidden from the list: Find the hidden process's name by comparing two process views.
- Persistence from the difference between two dumps: Compare dumps taken before and after and give the added persistence entry as the flag.
- The macro's hidden download address: Decode the macro in an inert document without running it and write the address as the flag.
- Lateral movement in the event log: Find the order of machines hopped to from logon events and build the flag.
- Catch the file with altered time: Find the file with tampered time from the mismatch between two time attributes and give the true time.
- Other evidence in place of a deleted log: Find the login the deleted log would have told of from another source.
- The question joining disk, memory and log: Form a single answer by taking one piece from each of three evidence sources.
- Timed round: five findings in 30 minutes: Extract five findings from a prepared incident package under a time limit and write the findings note.
About this course
In unguided tasks mixing disk, memory, log and document evidence you test your speed and accuracy, documenting each solution in a short findings note.
What you will learn
- Disk tasks
- Memory tasks
- Log and document tasks
- Mixed tasks
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.