Lion Cipher Lab
Keep a timestamped, hash-sealed investigation log with tmux and script (and see what bash history quietly loses)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
In an incident, the first thing anyone asks you afterwards is: what exactly did you run, when, and what did you see? Most people answer from memory or from bash history, and bash history keeps no output, no times by default, and nothing at all if the shell is killed. A responder whose notes write themselves, carry a timestamp on every line, survive a dropped connection and are sealed with a hash can answer that question in court, in a post-incident review or in a job interview. It costs nothing, takes ten minutes to set up, and it is the habit that separates a careful analyst from a lucky one.
What you'll learn
- Running an investigation inside a named tmux session that survives a closed window
- Logging every command and its output with tmux pipe-pane
- Recording and replaying a terminal session with util-linux script and scriptreplay
- Putting a UTC timestamp on every prompt so your notes are contemporaneous
- Stripping terminal escape codes from a raw log without touching the original
- Sealing case notes with a SHA-256 manifest and proving later tampering with sha256sum -c
- Knowing exactly what bash history does and does not keep
Steps in this lab
- Why your own keystrokes are evidence
- Get a Linux terminal and install tmux
- Build the case folder, a fixture to examine, and the triage list
- Before: run the triage with only bash history, then crash the shell
- Start a named tmux session and prove it survives a closed window
- Turn on pane logging and timestamped prompts
- After: run the same triage inside tmux, then crash it the same way
- Record a replayable session with script
- Seal the originals with a SHA-256 manifest, and keep a copy off the box
- Make a readable working copy: strip escape codes, keep the original
- Read the scorecard honestly: what this proves and what it does not
- Do it better: the way a pro makes this automatic