Lion Cipher Lab
10-minute drill: pick the evidence collection order on a live box
- Digital Forensics & IR (DFIR)
- Beginner
- ~10 min
- Free · no account required
Why it matters
When a machine is compromised and still running, the first few minutes decide what evidence survives. Some of it lives only in memory and vanishes on reboot; some of it sits on disk for weeks. A responder who collects in the wrong order, or who reaches for the power button, can destroy the one clue that explains the attack. Ordering evidence by how fast it disappears is the first judgement every DFIR interviewer checks.
What you'll learn
- order of volatility
- deciding what to collect first on a running machine
- why not to pull the plug
- using trusted tools on a suspect system
Steps in this lab
- The artifact: an incident note and seven things you could collect
- Rank by how fast each one disappears
- Two traps: the power button and the suspect's own tools
- How to say it out loud