Table of Contents

1. Challenge

   Getting Started in the Lab Environment

   Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

2. Challenge

   Acquiring and Verifying the Disk Image

   Your first step as a digital forensics investigator is to properly acquire the compromised server's disk image using FTK Imager. To maintain the integrity of the evidence, you must verify the image's cryptographic hash. This ensures that your copy is an exact, unaltered replica of the original evidence, a crucial step in preserving the chain of custody before beginning your analysis.

3. Challenge

   Setup Autopsy

   With the integrity of evidence verified, now you need to investigate what the user was doing on the compromised server. You will use Autopsy to create a new case and ingest the image. Your task is to run analysis modules to automatically parse and identify user activities, such as web browsing, file transfers, document access, to piece together the attacker's timeline and actions.

4. Challenge

   Analyzing User Activity

   Your investigation deepens as you hunt for system-level evidence and hidden data. The malicious actor may have tried to cover their tracks by deleting files. In this final analysis challenge, you will use Autopsy to dive into the system's core. You'll locate critical system configuration files, review event logs, registry data, and review deleted data that could hold the key to understanding the full extent of the compromise.

5. Challenge

   The Last Challenge

   Welcome to the final challenge! This is your last chance to experiment in the environment. Clicking Finish Lab will end this little world that flittered into existence just for you.