Digital & Cyber Forensics Practitioner

0. Orientation: what a forensic examiner is actually proving

A forensic tool does not create truth. It creates observations. Your job is to show how those observations were obtained, why they are reliable, what they support, and what they do not prove.

0A. Global Quality, Standards & Forensic Reliability

The standard is not “the tool produced an answer.” The standard is: the method is appropriate, the tool behavior is understood, the evidence is traceable, the result is reproducible, and limitations are explicit.

Publication quality gates

Lab 0 — Known-answer tool check

mkdir -p "$HOME/forensics-lab/kat" && cd "$HOME/forensics-lab/kat"
printf 'GNU Forensics KAT v1\n' > known-answer.txt
sha256sum known-answer.txt

# Expected SHA-256:
# d930e915a541ace97c1b53399fc6715dbe3eac1186ec3593ea144cf16cee2794

Evidence notebook — practice contemporaneous documentation

Use fictional training identifiers only. This browser-side notebook never sends data anywhere; export it as JSON for your own lab record. Do not enter real case-sensitive information into a public training page.

Standards and primary documentation anchors

• NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response
• NIST — Digital Investigation Techniques: Scientific Foundation Review
• NIST CFTT — Computer Forensics Tool Testing and CFReDS reference datasets
• ISO/IEC 27037:2012 — identification, collection, acquisition and preservation of digital evidence (ISO lists this edition as current/under review at the time of this manual’s review)
• SWGDE current published documents, including digital evidence collection, computer forensic acquisition/examination, mobile and cloud guidance
• Wireshark/TShark official manual and official installation guide
• Volatility 3 stable documentation, official source repository and PyPI package
• India Code — Bharatiya Sakshya Adhiniyam, 2023

0B. The GNU Legal Learning Model: Learn → Practice → Defend

The public reference is intentionally useful on its own. Paid value must come from doing forensic work under constraints, not from hiding basic knowledge behind a paywall.

0C. GNU Forensics Starter Evidence Lab — Case S01

Move from reading about forensic method to examining a compact evidence set. Case S01 — Unexpected Outbound Transfer is a GNU-created, fully synthetic, authorized training case designed for roughly 45–75 minutes when completed with the investigation-method records. It teaches integrity verification, evidence inventory, working-copy discipline, contemporaneous examination logging, timeline reconstruction, corroboration, competing hypotheses, finding traceability, defensibility review and restrained reporting.

# 1) Verify the downloaded ZIP against the published digest.
sha256sum GNU_Forensics_Starter_Evidence_Pack_v1.2.zip

# Expected:
# 24a26770790b072a6abd9803c26a22bc52705be1ad3b0d493a3c60c08e1508fc

# 2) Extract and verify every supplied evidence/template file.
unzip GNU_Forensics_Starter_Evidence_Pack_v1.2.zip
cd GNU_Forensics_Starter_Evidence_Pack_v1.1
./VERIFY.sh

# 3) Preserve evidence/ as the reference copy; create a working copy.
mkdir -p working
cp -a evidence/. working/

# 4) Orient yourself before analysis.
cat CASE_BRIEF.md
cat INVESTIGATION_METHOD.md
find evidence -type f -maxdepth 3 -print | sort

# 5) Create editable case records without changing the supplied templates.
mkdir -p working/records
cp templates/* working/records/

# Authentication / sudo activity
grep -nE 'Accepted|session opened|sudo:|session closed' evidence/endpoint/auth.log

# Shell-history commands (timestamp markers are stored as #epoch lines)
cat evidence/endpoint/bash_history.txt

# File metadata
cat evidence/endpoint/file_metadata.csv

# Proxy telemetry
grep -n 'upload.example.test' evidence/network/proxy.log

# Tool + file-access preflight
tshark -v
test -r evidence/network/egress_capture.pcap && echo "PASS: shell can read PCAP"
tshark -r evidence/network/egress_capture.pcap -c 1

# Beginner-safe fallback: create a temporary analysis copy.
mkdir -p /tmp/gnu-forensics-s01
chmod 700 /tmp/gnu-forensics-s01

cp evidence/network/egress_capture.pcap \
  /tmp/gnu-forensics-s01/egress_capture.pcap

# Both hashes MUST match before analysis.
sha256sum \
  evidence/network/egress_capture.pcap \
  /tmp/gnu-forensics-s01/egress_capture.pcap

# Confirm TShark can open the analysis copy.
tshark -r /tmp/gnu-forensics-s01/egress_capture.pcap -c 1

tshark -r evidence/network/egress_capture.pcap \
  -Y 'dns.qry.name' \
  -T fields -e frame.time -e ip.src -e dns.qry.name

tshark -r evidence/network/egress_capture.pcap \
  -Y 'http.request' \
  -T fields -e frame.time -e ip.src -e ip.dst \
  -e http.request.method -e http.host \
  -e http.request.uri -e http.content_length

1. Traditional Forensic Science Fundamentals

Chain of custody ≠ a hash

A hash is an integrity check on bytes. Chain of custody is the documented history of possession, handling, transfer, storage and examination. A perfect SHA-256 value cannot tell you who held a drive overnight or whether the evidence was lawfully obtained.

2. Cyber Forensics Fundamentals

3. The Digital Investigation Process

Bit-for-bit acquisition and verification

A forensic image attempts to reproduce addressable source data so analysis can occur on a copy. Hardware write blockers are commonly used with supported storage when appropriate; live, mobile, cloud and some modern storage workflows require different controls. Hashing is performed before/after or source/image as the workflow permits, with tool logs preserved.

mkdir -p "$HOME/forensics-lab/acquisition" && cd "$HOME/forensics-lab/acquisition"

# Create a 4 MiB synthetic source image. It is disposable lab data.
dd if=/dev/urandom of=evidence-source.img bs=1M count=4 status=none
printf 'CASE=LAB-ACQ-001\nNOTE=synthetic evidence\n' | \
  dd of=evidence-source.img bs=1 seek=65536 conv=notrunc status=none

# Record source hash before acquisition.
sha256sum evidence-source.img | tee source.sha256

# Create a bit-for-bit working image.
dd if=evidence-source.img of=evidence-copy.img bs=1M conv=noerror,sync status=progress
sync

# Verify both byte streams have the same SHA-256 value.
sha256sum evidence-source.img evidence-copy.img
cmp --silent evidence-source.img evidence-copy.img \
  && echo "PASS: byte-for-byte identical" \
  || echo "FAIL: images differ"

source:  SHA256 2c7e…9a10
copy:    [not acquired]

4. Computer / Disk Forensics

Assumes: file-system concepts from §2

mkdir -p "$HOME/forensics-lab/timeline" && cd "$HOME/forensics-lab/timeline"
rm -rf casefiles && mkdir casefiles
printf 'quarterly notes\n' > casefiles/notes.txt
sleep 1
printf 'invoice-id,amount\nA17,4200\n' > casefiles/invoice.csv
sleep 1
cp casefiles/invoice.csv casefiles/invoice-copy.csv
sleep 1
printf 'reviewed=yes\n' >> casefiles/notes.txt

# Portable-ish metadata view (GNU find on Linux).
find casefiles -maxdepth 1 -type f -printf '%TY-%Tm-%Td %TH:%TM:%TS  %s bytes  %p\n' | sort

# Inspect one file in more detail.
stat casefiles/notes.txt
sha256sum casefiles/*

5. Network Forensics

Assumes: TCP/IP and packet-vs-flow distinction from §2

# Verify the tool first:
tshark -v

# TShark display-filter examples for an authorized capture file:
tshark -r capture.pcapng -Y 'dns' -T fields -e frame.time -e ip.src -e dns.qry.name
tshark -r capture.pcapng -Y 'http.request' -T fields -e ip.src -e http.host -e http.request.uri
tshark -r capture.pcapng -Y 'tcp.port in {80,443,8080}'

6. Memory (RAM) Forensics

Assumes: processes, parent/child, sockets

RAM can reveal active processes, injected code indicators, command lines, network objects and transient data not present on disk. Acquisition changes memory to some extent; document the acquisition tool, time and limitations.

Tool setup — Volatility 3

For learners, the simplest reproducible route is to install the official volatility3 Python package inside a virtual environment. The Volatility Foundation currently requires Python 3.8 or later and documents the installed command as vol.

# 1) Confirm Python is available.
python3 --version

# 2) Create an isolated environment for forensic tooling.
python3 -m venv "$HOME/forensics-tools/volatility3-venv"
source "$HOME/forensics-tools/volatility3-venv/bin/activate"

# If the venv module is missing on Debian/Ubuntu/Pop!_OS, install python3-venv
# with your OS package manager, then repeat the two commands above.

# 3) Install the official Volatility 3 package from PyPI.
python -m pip install --upgrade pip
python -m pip install volatility3

# 4) Verify the installed CLI before using evidence.
vol -h

Preflight the memory image before plugin triage

# Ask Volatility to identify/support the Windows memory sample first:
vol -f MemDump.DMP windows.info

# Then compare multiple process/network views:
vol -f MemDump.DMP windows.pslist
vol -f MemDump.DMP windows.pstree
vol -f MemDump.DMP windows.psscan
vol -f MemDump.DMP windows.netscan

Why windows.info first? The Volatility quick-start uses it to obtain OS/kernel information and check that the sample can be processed before moving into plugin-specific analysis. Individual plugins can have additional requirements; inspect them with vol <plugin> -h.

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3

# The project documents its stable branch as the latest stable code line.
git switch stable

# Create an isolated environment and install the project dependencies.
python3 -m venv venv
source venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -e ".[full]"

# From the repository root, vol.py is now present:
python3 vol.py -h
python3 vol.py -f /path/to/MemDump.DMP windows.info
python3 vol.py -f /path/to/MemDump.DMP windows.pslist

7. Mobile Forensics

8. Cloud, Database, Email & Web Forensics

9. Malware Forensics & Anti-Forensics Detection

10. Advanced Techniques & Modern Cybercrime

11. Legal Aspects, Ethics & Expert Testimony

Jurisdiction lens

Select a legal lens. Global is the default methodology view; the others are scoped orientation notes, not complete statements of local law.

12. Customized Lab Generator

Choose the learner profile. The generator creates a compact practical path from the labs in this manual, including prerequisites and expected evidence outputs.

13. Capstone / Lab 8 — Real-time Incident Reconstruction

Scenario: an employee reports that a confidential PDF appeared outside the approved collaboration space. Your job is to reconstruct what the available synthetic evidence supports.

13A. Free Case Zero — Evidence → Hypothesis → Defensible Finding

Scenario: At 09:17 UTC, monitoring detected outbound activity from workstation WS-17. Investigators are asked whether confidential material was exfiltrated. Your job is not to confirm the allegation; your job is to determine what the supplied evidence supports.

14. Reporting: from technical artifact to defensible finding

15. Competency Check — Can You Work Like an Examiner?

Use this rubric after the capstone. The goal is observable competence, not memorization.

16. Lab Verification, Validation & Publication QA

Validation levels used by this edition

What this manual deliberately does not claim

• It is not laboratory accreditation, examiner certification, legal advice, a substitute for organizational SOPs, or validation of every version of any commercial/open-source forensic tool.
• Simulations teach reasoning; they do not reproduce every artifact, race condition, encryption state, provider behavior or device-specific acquisition constraint.
• Forensic conclusions remain dependent on the facts, collection method, tool behavior, source-system version and jurisdiction of the actual matter.

Reference anchors used to validate technical/legal statements

• NIST SP 800-86 — forensic techniques and the collection/examination/analysis/reporting lifecycle.
• NIST Digital Investigation Techniques scientific foundation review — reliability and limitations of digital investigation techniques.
• NIST CFTT/CFReDS — tool testing methodology and documented reference datasets for validation/proficiency use.
• ISO/IEC 27037:2012 — identification, collection, acquisition and preservation of digital evidence.
• SWGDE current guidance — digital evidence collection, acquisition, examination, mobile/cloud evidence and tool-testing expectations.
• Wireshark/TShark official documentation — installation, -r capture-file reading, capture vs display filters and -Y display-filter semantics.
• Volatility 3 stable documentation, official repository and PyPI metadata — Python requirement, installation, vol CLI, windows.info preflight, plugin model and source-checkout vol.py provenance; Volatility does not perform Windows memory acquisition.
• India Code — Bharatiya Sakshya Adhiniyam, 2023, Sections 61–63 and Schedule; reviewed 24 Sep 2026.
• SWGDE 10-Q-002-3.0 — training, competency, continuing education and continual assessment expectations.
• ISO/IEC 17025:2017 — competence, impartiality and consistent laboratory operation; current edition confirmed by ISO.
• SWGDE 19-Q-001 — QMS selection/implementation concepts for Digital & Multimedia Evidence organizations.
• SWGDE 18-Q-001-2.1 — baseline forensic tool testing and documentation.
• CASE/UCO — structured representation, provenance and investigative-action traceability.
• Forensic Science Regulator Code of Practice v2 — England & Wales quality requirements, in force 2 Oct 2025.
• U.S. Federal Rules of Evidence — current rules; electronic-record authentication orientation under Rules 901/902.
• EU Regulation 2023/1543 — European Production/Preservation Orders, applicable 18 Aug 2026.

17. Forensic Quality Management & Examiner Competence

Professional reliability comes from a managed system, not from an individual examiner being careful. ISO/IEC 17025 is an international competence standard for testing/calibration laboratories; SWGDE guidance adapts quality-system concepts to digital and multimedia evidence organizations whether or not they pursue accreditation.

The forensic quality loop

QMS maturity drill

18. Tool & Method Validation Laboratory

NIST CFTT and SWGDE both emphasize testing forensic-tool functions against defined requirements and known or independently checkable results. The goal is confidence in a specific function under specified conditions—not a blanket declaration that an entire tool can never fail.

Validation record template

Lab 9 — Browser known-answer test

GNU-LEGAL-DFIR-KAT-001|evidence-integrity|2026

What a defensible test record contains

19. Advanced Enterprise, Cloud, Container & AI Forensics

Modern investigations rarely stay on one disk. Enterprise evidence spans endpoints, identity providers, cloud control planes, SaaS, containers, orchestration, source control and AI-agent execution. The forensic challenge is preserving provenance while correlating different clocks, schemas and retention periods.

Enterprise correlation drill

20. Forensic Reasoning, Uncertainty & Cognitive Error

Digital evidence is rich enough to create convincing stories. Professional reasoning resists story-first analysis: observations are recorded before conclusions, alternative hypotheses are kept explicit, and the examiner asks what evidence would distinguish them.

Competing-hypothesis exercise

Classify how each evidence item bears on the hypotheses. There may be more than one reasonable interpretation; the review focuses on whether you avoid treating weak/contextual evidence as dispositive.

Bias controls

Observation → inference ladder

21. Global Professional Reference — Verification Matrix

Reference anchors added in v1.3

• ISO/IEC 17025:2017 — laboratory competence, impartiality and consistent operation
• SWGDE — QMS for Digital & Multimedia Evidence organizations
• SWGDE — Minimum Requirements for Testing Tools
• NIST CFTT
• CASE — structured cyber-investigation information and provenance
• England & Wales — Forensic Science Regulator Code v2
• United States — current Federal Rules of Evidence
• European Union — Regulation (EU) 2023/1543 e-Evidence

22. Continue to the GNU Legal Digital & Cyber Forensics Practitioner Lab

Keep this global professional reference free on legal.gnugroup.org. Deliver protected practitioner cases, saved progress and Razorpay entitlement on learn.gnugroup.org, where the Academy infrastructure already belongs. Graded assessment and certificate issuance remain gated until the practitioner workflow completes end-to-end validation.

Current and planned practitioner case roadmap