Lion Cipher Lab
Audit a whole evidence collection with a hashdeep manifest (and catch every change)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Real incident response rarely produces one tidy disk image. It produces a COLLECTION: process listings exported from a dozen hosts, auth logs pulled off servers, memory captures, screenshots, the analyst's own notes -- dozens or hundreds of files gathered by several people over several days, copied between laptops, a share, and an evidence drive. Weeks later someone asks the question that decides whether any of it is usable: has any of this changed since you collected it, and if so, exactly which file and how? Without a record made at collection time you cannot answer. A directory listing…
What you'll learn
- what a hash MANIFEST is (one line per file: size, SHA-256, path) and why a multi-file evidence collection needs one instead of a single image hash
- building a deterministic synthetic evidence folder (triage exports, auth logs, memory captures, analyst notes) on your own machine so every change is under your control
- running hashdeep in a throwaway Docker container on any OS, writing a manifest with `hashdeep -r -c sha256 -l`, and passing a clean audit
- reading hashdeep audit mode (-a, -v, -v -v) and its counters -- matched, moved, new, known-not-found -- including the two traps: a modified file is counted twice, and a byte-identical copy is reported as 'moved'
- using hashdeep's matching modes (-m, -x, -w, -X) and knowing which question each one answers -- and that neither can report a MISSING file
- writing a 55-line Python standard-library verifier that reads the same manifest and classifies every file as ok / MODIFIED / MOVED / DUPLICATE / NEW / MISSING, as a mechanism you understand and a fallback when hashdeep is not available
- the limits a court or opposing expert will press on: a manifest kept beside the evidence can be regenerated by whoever altered it, a hash proves sameness since the manifest was made (not authenticity at collection), and MD5 alone is collision-weak
Steps in this lab
- From one image hash to a manifest for a whole collection
- Generate a synthetic evidence collection (34 files, deterministic)
- Get hashdeep running in a throwaway Debian container
- Write the manifest and pass a clean audit
- The before: mishandle the evidence, then try to spot it without a manifest
- The after: read hashdeep's audit, including the two counters that surprise everyone
- Matching modes: -m, -x, -w and -X answer narrower questions
- Write your own verifier in Python (the mechanism, and a fallback)
- The honest negative: a manifest beside the evidence proves nothing
- The judgment: when a manifest is the right tool, and how a pro runs it