Home / Labs / Write the Evidence

Write the Evidence

Findings you cannot quote are findings you cannot act on. Practise capturing command output into files inside your case folder, so the evidence survives after the terminal scrolls away.

Open this lab

Commands practised here

• cmd > fileSend output to a file, replacing any existing content.
• cmd >> fileAdd to the end of a file. Safe for staged evidence.
• cmd > file 2>&1Capture errors as well as normal output.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Outbound Connections
• Permission Audit