Home / Labs / Forensic Disk Capture

Forensic Disk Capture

The attacker is out. Create a forensic disk image before evidence is lost on reboot.

Open this lab

Commands practised here

• cat /forensics/imaging-log.txtShows the complete forensic imaging log with all verification data.
• cat /forensics/hash-verification.txtShows the independent hash verification results.
• cat /forensics/imaging-command.txtShows the dd command and its raw output.
• grep 'match' /forensics/imaging-log.txtQuick check that all hash comparisons passed.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• The First Five Minutes
• Crack the Full Investigation