Lion Cipher Lab
Examine a disk image with The Sleuth Kit (command line)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Autopsy — the forensics GUI most people meet first — is just a friendly front end bolted onto The Sleuth Kit. Every 'recovered deleted file' and 'file system timeline' the GUI shows you is TSK doing the work underneath. Learn the command line and three things change: you can run forensics on a headless server over SSH where no GUI exists, you can script and automate triage across a hundred images instead of clicking through one, and you finally understand what the GUI is doing instead of trusting a black box. This lab makes that concrete by having you build your own disk image, delete a file,…
What you'll learn
- building a self-contained test disk image with dd and mkfs (no evidence to download)
- walking the TSK layers on the command line: mmls, fsstat, fls, istat, icat
- listing deleted files and reading how fls marks them
- recovering a deleted file's content by inode with icat
- generating a filesystem body file and timeline with fls -m and mactime
- the forensic-soundness mindset: work on a hashed copy, never mount the original
- knowing when metadata recovery fails and file carving takes over
Steps in this lab
- What The Sleuth Kit is, and why the command line
- Install The Sleuth Kit
- Build your own practice image (no evidence to download)
- Populate it, plant a secret, then delete a file
- Hash the image first — the forensic-soundness rule
- mmls — map the partition layout
- fsstat — read the filesystem's own details
- fls — list files and directories, including deleted ones
- istat then icat — read the metadata, then recover the bytes
- Build a timeline, then re-hash to prove nothing changed
- When this fails, and metadata recovery vs. carving — my take