Lion Cipher Lab
Reconstruct an incident timeline from Autopsy artifacts (deleted files, web history, USB, MAC times)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Autopsy will hand you a pile of artifacts — a deleted file here, a browser download there, a USB serial number, four different timestamps on one file — but it will never tell you the story. Reconstructing that story is the actual job of a DFIR analyst, and it is exactly what an interviewer or an incident lead will ask you to do: 'here are the findings, walk me through what happened.' This drill gives you a realistic set of findings from one invented case and makes you do the reconstruction, including the trap that catches beginners — trusting a single timestamp that turns out to be forged.…
What you'll learn
- reading the core Autopsy artifact types (deleted/recovered files, web & download history, recent documents / MRU, USB device history, MAC timestamps)
- understanding what file deletion does and does not remove
- distinguishing Modified vs Accessed vs Created vs Changed (MAC) timestamps
- ordering scattered artifacts into a single incident timeline
- spotting timestomping and knowing why timestamp SOURCE matters
- corroborating one artifact against another to build a defensible narrative
- writing a timeline as 'who did what when', each step backed by evidence
Steps in this lab
- The case, and how to read this drill
- MAC times: the four clocks on every file
- Artifact set 1 — Web & download history (Recent Activity)
- Artifact set 2 — Deleted / recovered files (and what deletion did not remove)
- Why MAC times lie: timestomping, and the tell in this case
- Artifact set 3 — USB device history
- Artifact set 4 — Recent documents / MRU
- Order it: build the timeline, and know when one artifact is enough vs. when you must corroborate
- Write it up, and keep the chain honest — my take