Digital Forensics & Incident Response Laboratory

Complete 5-Lab Course on the Cloudcore 2009 Incident

🎯 Course Overview

This is a comprehensive hands-on digital forensics course where you will conduct a real-world style investigation of a data exfiltration incident at Cloudcore Inc. You'll work through 5 progressive labs using professional forensic tools in a containerized environment to analyse evidence, recover deleted files, perform memory analysis, and produce professional incident response reports.

Case: CLOUDCORE-2009-INS-001 - Data Exfiltration Investigation

Environment: Docker-based forensic workstation

Tools: Sleuth Kit, Volatility, Autopsy GUI, Plaso, YARA, and more

Duration: 5 progressive labs (one per week, ~8-10 hours each)

📚 The 5 Labs

Lab	Title	Skills	Key Tools
1	USB_Imaging	Evidence handling, initial triage, deleted file recovery	Sleuth Kit, foremost, exiftool
2	Memory_Forensics	Volatile memory analysis, process investigation	Volatility 2 (Windows XP)
3	Email_Logs	Email artifact analysis, log examination	Python analysis, grep/awk
4	Network_Analysis	Network traffic analysis, C2 detection, exfiltration	Wireshark, tshark, PCAP analysis
5	Final_Report	Synthesis, timeline construction, professional reporting	All tools + reporting skills

📦 What's in This Package?

forensics-docker-lab/
├── README.md                           ← You are here (course overview)
├── docs/
│   ├── README.md                       ← Student documentation index (START HERE)
│   ├── scenario.md                     ← Complete case background and context
│   ├── setup.md                        ← Installation and Docker setup guide
│   ├── storyline.md                    ← Investigation timeline and narrative
│   ├── glossary.md                     ← Forensics terminology
│   ├── troubleshooting.md              ← Common issues and solutions
│   └── instructor/                     ← Instructor materials (on instructor branch)
│
├── cases/                              ← YOUR WORKSPACE (5 lab folders)
│   ├── USB_Imaging/                    ← Lab 1: Imaging, integrity & initial triage
│   ├── Memory_Forensics/               ← Lab 2: Memory analysis with Volatility
│   ├── Email_Logs/                     ← Lab 3: Email artifact analysis
│   ├── Network_Analysis/               ← Lab 4: Network traffic and C2 detection
│   ├── Final_Report/                   ← Lab 5: Synthesis and final reporting
│   └── Autopsy_GUI/                    ← Optional: Graphical forensic examination
│
├── evidence/                           ← READ-ONLY evidence files
│   ├── usb.img / usb.E01              ← USB device forensic image (~800MB)
│   ├── memory.raw                      ← Windows XP memory dump (~511MB)
│   └── network.cap                     ← Network traffic capture (~100MB)
│
├── templates/                          ← Student report templates
│   ├── README.md                       ← Template documentation
│   ├── lab_report_template.md          ← Individual lab report template
│   ├── final_report_template.md        ← Final synthesis report template
│   ├── chain_of_custody.csv            ← CoC log template
│   └── analysis_log.csv                ← Analysis tracking template
│
├── guides/                             ← Interactive guides (HTML)
│   ├── chain-custody-guide.html        ← Chain of custody reference
│   └── forensic-image-primer.html      ← E01 format overview
│
├── rules/                              ← YARA malware detection rules
│   └── README.md                       ← How to use YARA rules
│
├── scripts/
│   ├── forensics-workstation           ← Immersive login script (bash)
│   ├── forensics-workstation.ps1       ← Immersive login script (PowerShell)
│   ├── coc-log                         ← Chain of custody logging utility
│   ├── verify_setup.sh                 ← Setup verification (bash)
│   ├── verify_setup.ps1                ← Setup verification (PowerShell)
│   ├── legacy/                         ← Old scripts (for reference)
│   └── instructor/                     ← Instructor-only tools (on instructor branch)
│
├── images/
│   ├── dfir-cli/                       ← Main forensic workstation container
│   └── volatility2/                    ← Windows XP memory analysis (vol2)
│
├── docker-compose.yml                  ← Container orchestration
└── LICENSE

🚀 Quick Start (5 Minutes)

TL;DR - Just Run These Commands

First time setup (choose one):

Option A: Using Make (recommended - simplest)

cd forensics-docker-lab
make setup
make verify
make start

Option B: Direct scripts

cd forensics-docker-lab
docker compose build
./start.sh          # or start.bat on Windows

Every other time:

make start          # or ./start.sh / start.bat

Detailed Setup

Step 1: Prerequisites

Install Docker Desktop:

Windows/Mac: Download from https://www.docker.com/products/docker-desktop

Linux (Ubuntu/Debian):

sudo apt update
sudo apt install docker.io docker-compose
sudo usermod -aG docker $USER
# Log out and back in for group changes to take effect

Verify Installation:

docker --version
docker compose version

System Requirements:

4GB RAM minimum (8GB+ recommended for Autopsy GUI)
15GB free disk space (for all evidence files)
Internet connection (first build only)

Step 2: Build the Forensic Environment

cd /path/to/forensics-docker-lab
make setup

Or manually:

docker compose build
docker compose run --rm dfir echo "Environment ready!"

Step 3: Verify Your Setup (Recommended)

make verify

Or manually:

Windows: scripts\verify_setup.bat
macOS/Linux: ./scripts/verify_setup.sh

All checks should pass (✓ in green).

Step 4: Enter the Forensic Workstation

make start

Or directly:

Mac/Linux: ./start.sh (or ./scripts/forensics-workstation)
Windows: start.bat (or scripts\forensics-workstation.bat)

You'll be prompted for your analyst name, then you're inside:

╔═════════════════════════════════════════════════════════════════╗
║                                                                 ║
║     DIGITAL FORENSICS & INCIDENT RESPONSE LABORATORY            ║
║                                                                 ║
║     Cloudcore 2009 Data Exfiltration Investigation              ║
║                                                                 ║
╚═════════════════════════════════════════════════════════════════╝

alice@forensics-lab:/cases$

Now run forensic commands directly (no docker compose prefix!):

# Example: List evidence files
ls -la /evidence/

# Example: Verify USB image integrity
sha256sum /evidence/usb.E01

# Example: Start Lab 1 analysis
mkdir -p USB_Imaging/output
cd USB_Imaging
fls -r /evidence/usb.img > output/fls.txt

# When done
exit

📖 How to Use This Lab

First Time? Start Here:

Read the Course Overview (this page - 10 min)
Review docs/README.md - Student documentation index (10 min)
Read docs/scenario.md - Complete case background (20 min)
Build Docker environment - Step 2 above (5 min)
Verify setup - Step 3 above (5 min)
Enter workstation - Step 4 above (1 min)

For Each Lab:

Read the lab README - e.g., cases/USB_Imaging/README.md
Review the walkthrough - e.g., cases/USB_Imaging/WALKTHROUGH.md
Enter the workstation - make start (or ./start.sh / start.bat)
Run analysis commands - Follow lab walkthrough commands
Fill the report - Copy templates/lab_report_template.md to your lab folder
Log your actions - Use coc-log for chain of custody

Quick Reference:

Stuck on a lab? → See that lab's WALKTHROUGH.md
Want to understand the case? → See docs/scenario.md
Need timeline context? → See docs/storyline.md
Terminology confused? → See docs/glossary.md
Setup issues? → See docs/troubleshooting.md

🔑 Key Features

✅ Immersive Forensic Workstation

Instead of typing docker compose run --rm dfir every time, use:

make start          # Recommended: simplest option
# or
./start.sh          # Direct on Linux/Mac
start.bat           # Direct on Windows
./scripts/forensics-workstation     # Full path (equivalent to start.sh)

Benefits:

🎯 Feels like connecting to a real DFIR workstation
📝 Your analyst name is logged in chain of custody
⚡ Less typing = faster workflow
🏢 Matches real-world incident response practice

✅ Automatic Chain of Custody Logging

The coc-log utility automatically timestamps and hashes all commands:

coc-log "fls -r /evidence/usb.img" "Initial filesystem analysis"

Results are logged to cases/analysis_log.csv with:

Timestamp (UTC)
Analyst name
Command executed
Exit code
Output hash (SHA256)
File size
Your notes

✅ Complete Evidence Package

All evidence files are included:

usb.img / usb.E01 - USB device forensic image (800MB)
memory.raw - Windows XP memory dump (511MB)
network.cap - Network traffic capture (100MB)

Read-only to prevent accidental modification. All analysis happens in writable ./cases/ folders.

✅ Multi-Platform Support

Windows: PowerShell scripts with Docker Desktop + WSL 2
macOS: Intel and Apple Silicon (M1/M2/M3) support
Linux: Ubuntu, Debian, Fedora, etc.

🖥️ Platform-Specific Notes

Windows Users

Terminal: Use Windows Terminal with Command Prompt or PowerShell (both work)

Docker Desktop Setup:

Enable WSL 2 backend (default)
Allocate 4GB+ RAM in Docker Desktop settings
Ensure Docker Desktop is running

Commands:

# Use batch scripts for Windows:
scripts\verify_setup.bat
scripts\forensics-workstation.bat

# Docker commands work the same:
docker compose build
docker compose run --rm dfir

Common Issues:

"Command not found": Restart Docker Desktop
"Access denied": Run Command Prompt as Administrator
Batch file won't run: Ensure you're in the correct directory
PowerShell execution policy: Use batch files instead (no PowerShell required)

macOS Users (Intel and Apple Silicon)

Terminal: Use built-in Terminal or iTerm2

Apple Silicon (M1/M2/M3):

Docker uses Rosetta 2 (automatic translation)
Performance is excellent
First build may take 5-7 minutes

Commands:

./scripts/verify_setup.sh
./scripts/forensics-workstation

Linux Users (Ubuntu/Debian/Fedora)

Docker Group Setup (one-time):

sudo usermod -aG docker $USER
# Log out and back in
groups | grep docker  # verify

Commands:

./scripts/verify_setup.sh
./scripts/forensics-workstation

💡 Essential Commands

Starting Your Forensic Session

Mac/Linux/WSL:

# Enter the immersive workstation (RECOMMENDED)
./scripts/forensics-workstation

# Or use Docker directly (for advanced users)
docker compose run --rm -it dfir bash

Windows:

# Enter the immersive workstation (RECOMMENDED)
scripts\forensics-workstation.bat

# Or use Docker directly (for advanced users)
docker compose run --rm -it dfir bash

Inside the Workstation

# Lab 1: Analyse the USB image
mkdir -p USB_Imaging/output
fls -r /evidence/usb.img > USB_Imaging/output/fls.txt

# Lab 2: Memory analysis (run on host, not inside workstation)
docker compose exec vol2 vol.py -f /evidence/memory.raw imageinfo

# Lab 5: Network analysis (run on host, not inside workstation)
tshark -r evidence/network.cap -Y "irc"

# Always exit when done
exit

Chain of Custody

Log commands for evidence handling:

# Inside workstation
coc-log "fls -r /evidence/usb.img" "Lab 1 filesystem listing"

# This creates: cases/analysis_log.csv with timestamp, hash, analyst name

See complete reference: docs/COMMANDS.md

📁 Workspace Organisation

Evidence Directory (`./evidence/`)

READ-ONLY - Never modify:

usb.img / usb.E01 - USB device image
memory.raw - Memory dump
network.cap - Network capture

Mounted inside container as /evidence

Cases Directory (`./cases/`)

WRITABLE - Save all your work:

Mounted inside container as /cases
Everything you create in /cases/ appears in ./cases/ on your host
One folder per lab (USB_Imaging, Memory_Forensics, etc.)

Example structure:

./cases/
├── USB_Imaging/
│   ├── README.md          ← Lab 1 instructions
│   ├── WALKTHROUGH.md     ← Step-by-step guide
│   ├── output/            ← Your analysis outputs
│   ├── recovered/         ← Recovered files
│   └── report.md          ← Your report (copy from templates/WORKBOOK.md)
├── Memory_Forensics/
│   ├── README.md
│   ├── WALKTHROUGH.md
│   ├── vol_output/
│   └── report.md
└── [etc for other labs...]

🔧 Troubleshooting

"Docker command not found"

Fix:

Ensure Docker Desktop is running (Windows/Mac)
Restart terminal after installing Docker
Linux: sudo systemctl start docker

"Cannot connect to Docker daemon"

Fix:

Windows/Mac: Start Docker Desktop application
Linux: sudo systemctl start docker

"Permission denied" on /evidence

This is expected! Evidence is read-only.

✅ Correct: fls -r /evidence/usb.img > /cases/output.txt
❌ Wrong: fls -r /evidence/usb.img > /evidence/output.txt

"Build failed" or "Container won't start"

Fix:

docker compose down -v
docker compose build --no-cache

"Port 8080 already in use" (if using Autopsy)

Fix: Edit docker-compose.yml and change 8080:8080 to 8081:8080

Getting More Help

Lab Session: Ask instructor or TAs
Office Hours: See course syllabus for times
LMS Forum: Post technical questions
Documentation: Review docs/COMMANDS.md, docs/SCENARIO.md, lab WALKTHROUGH.md

See docs/TROUBLESHOOTING.md for more detailed troubleshooting.

🧠 Learning Objectives

By completing all 5 labs, you will:

✅ Understand proper digital evidence handling (chain of custody, hashing, integrity verification)
✅ Master industry-standard forensic tools (Sleuth Kit, Volatility, Autopsy, Wireshark)
✅ Analyse multiple evidence types (disk images, memory dumps, network captures, logs)
✅ Perform deleted file recovery and carving
✅ Conduct memory forensics on legacy Windows systems
✅ Identify and analyse command & control communications
✅ Construct timelines and correlate events across multiple data sources
✅ Write professional incident response reports
✅ Understand real-world incident response workflow
✅ Critically reflect on AI tool usage in forensic investigations

📝 Next Steps

Today:

✅ Read this README (you're doing it!)
→ Read docs/README.md for documentation index
→ Read docs/SCENARIO.md for case background
→ Build Docker environment (Quick Start above)

This Week (Lab 1):

→ Read cases/USB_Imaging/README.md
→ Follow cases/USB_Imaging/WALKTHROUGH.md
→ Use docs/COMMANDS.md for command reference
→ Complete Lab 1 analysis and report

Coming Up:

Week 2: Memory_Forensics (Volatility)
Week 3: Email_Logs (log analysis)
Week 4: Network_Analysis (PCAP analysis)
Week 5: Final_Report (synthesis + reporting)

🎓 Course Materials

For Students (main branch):

docs/README.md - Documentation index
docs/scenario.md - Case background
docs/setup.md - Installation guide
docs/storyline.md - Investigation timeline
Lab folders: cases/USB_Imaging/, cases/Memory_Forensics/, etc.

For Instructors (instructor branch):

git checkout instructor

docs/instructor/README.md - Instructor materials overview
cases/*/instructor/INSTRUCTOR_NOTES.md - Teaching tips for each lab
cases/*/instructor/answer_key.md - Expected findings
cases/*/instructor/rubric.csv - Grading rubrics

⚖️ Academic Integrity Reminder

This is an individual assessment - collaborate on concepts, not code
AI tools are permitted but must be documented in your reflection
Never copy-paste AI outputs without understanding
Verify all commands before executing them
Your work should be reproducible - document every step
Never modify evidence files - work on copies only

🆘 Need Help?

Technical Issues:

Check docs/troubleshooting.md
Review error messages carefully
Search error online (with "docker" + tool name)
Post on LMS forum with: OS, error message, what you were trying, what you've tried

Forensic Concepts:

Review docs/scenario.md and docs/storyline.md
Attend lab session and office hours
Check tool documentation (Sleuth Kit, Volatility, etc.)
Ask on LMS forum

Lab-Specific Help:

Review that lab's README.md
Follow the lab's WALKTHROUGH.md
Ask instructor during lab session

🔒 Important Notes

Never modify evidence files - work on copies only
Document everything - reproducibility is key
Report objectively - present facts, not accusations
Test your submission - ensure all files are included
Start early - don't wait until the last day
Ask questions - better to ask than guess

📚 Forensic Tools & Resources

Core Tools (Pre-Installed)

Sleuth Kit (fls, icat, tsk_recover, fsstat, istat): https://sleuthkit.org/sleuthkit/docs.php
Volatility 2: For Windows XP and older memory analysis - https://volatility-labs.blogspot.com/
Volatility 3: Modern memory forensics framework - https://volatility3.readthedocs.io/
tshark: Command-line network packet analyzer - https://www.wireshark.org/docs/man-pages/tshark.html
YARA: Malware pattern matching and detection - https://virustotal.github.io/yara/
Autopsy: GUI forensic analysis platform - https://www.sleuthkit.org/autopsy/

Additional Resources

Wireshark: Network protocol analyzer (GUI complement to tshark) - https://www.wireshark.org/docs/
YARA Rules Repository: Community malware detection rules - https://github.com/Yara-Rules/rules

Good luck with your investigation! Remember: professionalism, documentation, and objectivity are the hallmarks of excellent forensic work.

Name		Name	Last commit message	Last commit date
Latest commit History 136 Commits
cases		cases
docs		docs
evidence		evidence
guides		guides
images/dfir-cli		images/dfir-cli
rules		rules
scripts		scripts
templates		templates
.env		.env
.gitattributes		.gitattributes
.gitignore		.gitignore
ATTRIBUTIONS.md		ATTRIBUTIONS.md
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
docker-compose.yml		docker-compose.yml
start.bat		start.bat
start.sh		start.sh

License

michael-borck/forensics-docker-lab

Folders and files

Latest commit

History

Repository files navigation

Digital Forensics & Incident Response Laboratory

Complete 5-Lab Course on the Cloudcore 2009 Incident

🎯 Course Overview

📚 The 5 Labs

📦 What's in This Package?

🚀 Quick Start (5 Minutes)

TL;DR - Just Run These Commands

Detailed Setup

Step 1: Prerequisites

Step 2: Build the Forensic Environment

Step 3: Verify Your Setup (Recommended)

Step 4: Enter the Forensic Workstation

📖 How to Use This Lab

First Time? Start Here:

For Each Lab:

Quick Reference:

🔑 Key Features

✅ Immersive Forensic Workstation

✅ Automatic Chain of Custody Logging

✅ Complete Evidence Package

✅ Multi-Platform Support

🖥️ Platform-Specific Notes

Windows Users

macOS Users (Intel and Apple Silicon)

Linux Users (Ubuntu/Debian/Fedora)

💡 Essential Commands

Starting Your Forensic Session

Inside the Workstation

Chain of Custody

📁 Workspace Organisation

Evidence Directory (./evidence/)

Cases Directory (./cases/)

🔧 Troubleshooting

"Docker command not found"

"Cannot connect to Docker daemon"

"Permission denied" on /evidence

"Build failed" or "Container won't start"

"Port 8080 already in use" (if using Autopsy)

Getting More Help

🧠 Learning Objectives

📝 Next Steps

Today:

This Week (Lab 1):

Coming Up:

🎓 Course Materials

⚖️ Academic Integrity Reminder

🆘 Need Help?

🔒 Important Notes

📚 Forensic Tools & Resources

Core Tools (Pre-Installed)

Additional Resources

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Contributors 2

Uh oh!

Languages

Evidence Directory (`./evidence/`)

Cases Directory (`./cases/`)

Packages