Recovery and forensics in Git
You recover corrupted, wrongly rewritten or tampered repositories and answer who changed what and when, with evidence.
Level 501 · 12 lessons · 12 practice labs
Lessons
Loss and corruption
- Finding dangling objects: fsck --lost-found
- Repairing corrupt objects and packs
- Recovering a branch overwritten by a force push
- Short task: rescue all the work from a half-corrupted repository
Forensics
- Author, committer and dates: what you can trust
- Spotting tampered history
- Building the timeline of a leaked secret
- Using reflogs and server logs as evidence
- Finding and removing a commit that added a backdoor
- Short task: write the incident timeline of a suspicious change
Wrap-up
- Writing a response runbook for Git incidents
- Capstone: investigate, clean and report on a compromised repository
Practice labs
- Recover a file that was never committed: Find the contents of a file that was staged, then wiped by a reset and never committed, among the dangling blobs, and write the file back in full.
- Rescue an overwritten branch from someone’s copy: Bring back a branch overwritten on the server by a force push, with no local reflog, from a bundle a teammate gave you, restore it on the server and show the lost commits are back.
- A corrupt pack file: Find which objects are affected in the pack that fsck reports as corrupt, salvage the good objects, fill in the missing ones from a backup clone and show the repository passes fsck.
- Can we trust these dates?: List the commits in the repository whose author and committer dates differ oddly or run out of order, and explain in one sentence why each is suspicious.
- History rewritten after the fact: Compare the server repository with an old backup clone to find rewritten commits, work out which files and lines were changed and report your findings.
- Code hidden in a formatting commit: Find the malicious lines hidden inside a big ‘formatting only’ commit in Copperleaf Insurance’s repository using a whitespace-ignoring diff, revert them and report with evidence.
- Which commits hold the leaked token?: Search all of history for every commit containing the reported leaked access token and the branches and tags that contain them, and write the list into a report.
- Who did the force push?: Combine server hook logs and developers’ reflogs into a timeline showing who force-updated main, when, and which commits it removed.
- Purge the leak and report it: Purge the leaked private key from every branch and tag in the lab repository by rewriting history, flush old references and caches, prove no trace remains and write a short incident report.
- Copy the repository before you touch it: Take a full mirror copy of the lab repository reported for a suspicious change, including reflogs and dangling objects, record the copy’s checksum and write to the answer file which data a plain clone would have lost.
- An inventory of what was saved from a half-corrupted repository: In Göktaşı Yazılım’s repository damaged while the disk filled up, separate the intact branches, the dangling commits that can be saved and the objects that cannot be brought back, move what was saved into a new repository and write the inventory of the loss.
- Test the Git incident runbook in a drill: Follow the given incomplete response runbook step by step through a force-push and leaked-key scenario in the lab repository, find the three steps that fail or are missing, fix the runbook and collect evidence for every step in a second drill.
About this course
You recover corrupted, wrongly rewritten or tampered repositories and answer who changed what and when, with evidence.
What you will learn
- Loss and corruption
- Forensics
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.