Digital forensics fundamentals: dd, Foremost, ExifTool
Evidence handling, timelines and disk examination.
Level 201 · 17 lessons · 15 practice labs
Lessons
Principles and devices
- Forensics principles and chain of custody: You will understand the core principles of digital forensics and how the chain of custody shows who held the evidence and that it was not altered.
- Identifying the storage device with lsblk: You will learn to correctly identify the storage device to examine and to avoid touching the wrong disk.
- Write protection: blockdev --setro and hardware blockers
- Short task: make the lab disk read-only and prove it
Imaging and integrity
- Taking a disk image with dd: You will learn to take an exact copy (image) of a disk with dd, and why you must never write anything to the original disk.
- Verifying the image's integrity with sha256sum: You will learn how a SHA-256 fingerprint (hash) proves that an image still matches the original disk and has not changed since.
- Forensic imaging with dd versus file copying: You will understand why a forensic image differs from an ordinary file copy, and how it captures deleted traces and unused space.
- Hashing while imaging with dcfldd
- Short task: image a partition and verify it with two hashes
Recovery and metadata
- File carving with Foremost: recovering deleted files: You will learn file carving: recovering documents from data left on disk even after the file entry was deleted, using your own lab image.
- Extracting metadata with ExifTool: You will learn to read the metadata inside files with ExifTool, such as author, dates and device, and what it adds to an investigation.
- Separating embedded data and spotting hidden content with binwalk: You will find and extract other files embedded inside an image or firmware file with binwalk.
- Recovering files by format with PhotoRec
- Short task: recover photos from a formatted stick
Timeline and report
- Building a timeline: You will learn to line up timestamps from different sources into one sequence, building a timeline of what happened and in what order.
- Writing an evidence report: You will learn to write a plain evidence report that states your findings, proof and limits clearly enough for someone else to verify.
- Capstone: find a deleted document and report it (Foremost, ExifTool): Capstone: in a fictional company's employee disk image, you find a deleted document, verify its integrity and present your findings in a short report.
Practice labs
- Identify the storage device: Extract the lab disk's name, size and partitions with lsblk.
- Make the lab disk read-only and prove it: Protect the disk with blockdev --setro and show a write attempt being refused.
- What changes without write protection: Show with before and after hashes which timestamps and journal areas change on a disk mounted unprotected.
- Image a partition with dd: Image a partition with dd and verify its size equals the source.
- Verify an image with two hashes: Take MD5 and SHA-256 hashes of source and image and record the match.
- Hash while imaging with dcfldd: Image with dcfldd producing piecewise hashes and find in which piece a damaged block lies.
- The difference between a forensic image and a file copy: Compare what an image and a file copy of the same disk contain and write what the copy lacks.
- Mount the image and list the contents: Mount the image read-only through a loop device and list the user folders.
- The deleted file a copy cannot see: Show a deleted file exists only in the image and explain why it is not in the copy.
- Recover files with Foremost: Carve JPEG and PDF files from an image and report the number recovered.
- Read the metadata of a recovered file: Extract the author and date of the recovered documents with ExifTool.
- Find and report the deleted document: Recover the deleted contract document in the Mavikaya Lojistik image, verify its metadata and write up the finding.
- Build a simple timeline: Produce an ordered event list from the modification times of ten files.
- Write a finding reproducibly: Document one finding with command, output and hash so someone else can verify it.
- Write an evidence report: Write a one-page report for a small examination under scope, method, findings and limitations.
About this course
Evidence handling, timelines and disk examination.
What you will learn
- Principles and devices
- Imaging and integrity
- Recovery and metadata
- Timeline and report
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.