Lion Cipher Lab
Make a forensic image and prove it wasn't altered
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
"Here is a disk image — find out what happened" is how nearly every digital-forensics investigation and practice room begins. Before anyone analyses anything, someone has to capture the evidence in a way a court, a client, or an incident report can trust. That capture has two non-negotiable halves: you copy the data bit-for-bit so you can work on the copy and leave the original untouched, and you hash both so you can later prove the copy is identical and nothing was changed. Forensics guidance builds directly on this — collect data with its integrity preserved, and use a cryptographic hash to…
What you'll learn
- forensic imaging
- bit-for-bit copies with dd
- hashing evidence with sha256sum
- verifying integrity with sha256sum -c
- write-blocking basics
- chain of custody basics
Steps in this lab
- The golden rule: work on a copy, never the original
- Build a safe practice "device" from a file
- Fingerprint the source FIRST
- Write-blocking: keep the original read-only
- Make the bit-for-bit image
- Prove it matches — the integrity check
- Chain of custody: the record that makes it hold up
- Why this is the skill every DFIR room assumes