Hands-On Evidence Labs

Real Evidence.
Real Questions.
Real Answers.

Every lab gives you a real forensic evidence file — a disk image, memory dump, registry hive, or event log. You open it in a tool, dig through it, and answer specific questions based on what you actually find. No scripts to run. No simulations. Just you and the evidence.

FormatEvidence-based

Labs8 investigations

Questions45+ specific Q&A

Evidence FilesReal images & dumps

⚠️

How this workbook works differently: Each lab tells you exactly which evidence file to download (disk image, memory dump, registry hive, or EVTX file). You open it in the specified free tool. You answer specific questions — exact filenames, timestamps, event IDs, hash values — from what you see in the tool. The reveal button shows the exact correct answer so you can check your work. No guessing. No simulations.

⬡ Setup

Lab 00 — Tools & Evidence Files

Install every tool used across all labs. Most evidence files are downloaded at the start of each lab — but install the tools now so you are ready.

⏱ 20 min

🌐 Internet + Windows 10/11

Install free tools

0.1

EZ Tools (Eric Zimmermann)

PECmd, EvtxECmd, MFTECmd, LECmd, RECmd, Timeline Explorer — all in one

Open PowerShell as Administrator and run:

PowerShell — Admin

New-Item -ItemType Directory -Force C:\labs\tools
Invoke-WebRequest -Uri "https://f001.backblazeb2.com/file/EricZimmermanTools/Get-ZimmermanTools.zip" -OutFile C:\labs\tools\ez.zip
Expand-Archive C:\labs\tools\ez.zip -Destination C:\labs\tools\EZ -Force
Set-ExecutionPolicy Bypass -Scope Process -Force
C:\labs\tools\EZ\Get-ZimmermanTools.ps1 -Dest C:\labs\tools\EZ

ℹ️

If the installer fails: go to ericzimmermann.com/tools, download manually, extract to C:\labs\tools\EZ\. Confirm files like PECmd.exe and EvtxECmd.exe exist.

0.2

Autopsy (disk image analysis GUI)

Free open-source forensic platform — used in Labs 05 and 08

Go to autopsy.com/download/
Download the Windows installer (64-bit)
Install with default options

0.3

Volatility 3 (memory forensics)

Used in Lab 07

PowerShell — Admin

python --version   # must be 3.8+
pip install volatility3
vol -h 2>&1 | Select-String "Volatility"

0.4

SQLite Browser (browser forensics)

Used in Lab 06

Download DB Browser for SQLite from sqlitebrowser.org — free, open source, Windows installer available. Install with defaults.

⬡ Lab 01

Registry — Who Ran What

You are given a real NTUSER.DAT hive exported from a suspect workstation. Open it in Registry Explorer and answer questions about what the user ran, what they recently accessed, and what persistence was installed.

⏱ 45 min

🛠 Registry Explorer, RECmd

🎯 5 questions

Get the evidence file

💾

NTUSER.DAT — Suspect Workstation (DFIR.training sample)

https://github.com/strozfriedberg/sidr/raw/master/test-data/NTUSER.DAT

Format: Windows Registry Hive | Size: ~3 MB | No password

Save to: C:\labs\lab01\NTUSER.DAT

PowerShell — download the evidence file

New-Item -ItemType Directory -Force C:\labs\lab01
Invoke-WebRequest -Uri "https://github.com/strozfriedberg/sidr/raw/master/test-data/NTUSER.DAT" -OutFile C:\labs\lab01\NTUSER.DAT
# Verify it downloaded
Get-Item C:\labs\lab01\NTUSER.DAT | Select-Object Name, Length

Open in Registry Explorer

1.1

Load the hive into Registry Explorer

Read-only analysis — you cannot modify the evidence file

Run C:\labs\tools\EZ\RegistryExplorer\RegistryExplorer.exe
File → Load Offline Hive
Browse to C:\labs\lab01\NTUSER.DAT and open it
The hive loads as HKCU in the left panel

ℹ️

Registry Explorer will prompt about transaction logs (.LOG1 / .LOG2 files). These are missing because we only have the hive — click OK / continue without logs.

Questions — answer from the hive

Q1.1Navigate to SOFTWARE\Microsoft\Windows\CurrentVersion\Run. How many autostart entries exist? List every value name and the executable path it points to.

💡In Registry Explorer, use the left tree to expand HKCU → SOFTWARE → Microsoft → Windows → CurrentVersion → Run. Each value in the right panel is an autostart entry.

Navigate to: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Count the values in the right-hand pane. For each value: note the Name column (value name) and Data column (executable path). Entries that point outside of C:\Windows\, C:\Program Files\, or C:\Program Files (x86)\ are immediately suspicious — legitimate software rarely autoruns from AppData, Temp, or ProgramData.

Q1.2Navigate to SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. Find the subkey containing program execution records. List the 3 most recently run programs. What is the run count for each?

💡Expand the UserAssist key — there are two subkeys with GUIDs. Expand each → Count. Registry Explorer shows decoded (ROT-13 reversed) names automatically in the Value Name column. Sort by the timestamp binary value to find most recent.

Path: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\ {GUID}\Count Registry Explorer decodes the ROT-13 names in the Value Name column automatically. Each value contains binary data encoding: run count (offset 4, 4 bytes, little-endian int) and last run time (offset 8, 8 bytes, Windows FILETIME). Registry Explorer displays these decoded in the bottom panel when you click a value. Look for the "Count" and "Last Executed" fields. Red flags to note: - Executables run from %TEMP%, %APPDATA%, or non-standard paths - Programs with very high run counts that you don't recognise - Programs run at unusual hours (check the timestamp)

Q1.3Navigate to SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs. What is the most recently accessed file? What extension type has the most entries? Does a .zip or .rar subkey exist — and if so what files appear there?

💡Expand RecentDocs — you will see subkeys for each extension (e.g. .docx, .pdf, .zip). Click each to see the MRU (Most Recently Used) list. The MRUListEx value tells you the order — the first byte is the most recently accessed index.

Finding .zip or .rar in RecentDocs means the user recently opened an archive. In an investigation context this is significant because: 1. Malware is frequently delivered inside ZIP files 2. Attackers archive data before exfiltrating it (data staging) 3. The filename in the MRU entry often reveals what was inside Even if the ZIP file was later deleted, the RecentDocs entry proves it existed and was opened — you have the filename, which you can use to search other artefacts (Prefetch, LNK files, browser downloads) to find where it came from.

Q1.4Navigate to SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths. List all paths. Do any look like network shares (starting with \\)? What does each path tell you about where the user navigated?

TypedPaths records every path the user MANUALLY TYPED into the Explorer address bar. This is different from Shellbags (which records all navigation including mouse clicks). A network path like \\FILESERVER\Finance\ typed here proves: - The user deliberately navigated to that share - They knew the path (suggesting familiarity with the environment) - It happened even if no server-side access log exists In an intrusion investigation: an attacker who maps the network manually types server paths to explore — these show up in TypedPaths on the machine they used. This is how you prove lateral movement even without network logs.

Q1.5Now run RECmd against the same hive to extract a full CSV report. Open it in Timeline Explorer. Search for the word "startup" or "run". How many results appear? Do any of the found entries differ from what you found manually in Q1.1?

PowerShell — run RECmd

$ez = "C:\labs\tools\EZ"
& "$ez\RECmd.exe" -f C:\labs\lab01\NTUSER.DAT --bn "$ez\BatchExamples\Kroll Batch MC.reb" --csv C:\labs\lab01\ --csvf results.csv
Start-Process "$ez\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab01\results.csv"

⬡ Lab 02

Event Logs — Logon Investigation

You are given a real Security.evtx file from an incident. Parse it with EvtxECmd, load it in Timeline Explorer, and answer specific questions about who logged in, from where, and what changed.

⏱ 60 min

🛠 EvtxECmd, Timeline Explorer

🎯 6 questions

Get the evidence file

📋

Security.evtx — from EVTX-ATTACK-SAMPLES (real attack logs)

https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Lateral%20Movement/LM_wmi_remote.evtx

Format: Windows Event Log (.evtx) | Contains: WMI lateral movement events

Save to: C:\labs\lab02\attack_sample.evtx

ℹ️

EVTX-ATTACK-SAMPLES is a public GitHub repository by Samir Bousseaden containing real .evtx files captured during actual attack technique executions. These are widely used in forensics training. We will use several files from this repository across labs.

PowerShell — download evidence files for Lab 02

New-Item -ItemType Directory -Force C:\labs\lab02

# WMI lateral movement sample
Invoke-WebRequest -Uri "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Lateral%20Movement/LM_wmi_remote.evtx" -OutFile "C:\labs\lab02\LM_wmi_remote.evtx"

# Pass-the-Hash lateral movement sample
Invoke-WebRequest -Uri "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Lateral%20Movement/LM_pass_the_hash_logon.evtx" -OutFile "C:\labs\lab02\LM_pass_the_hash.evtx"

# Credential access — LSASS dump via procdump
Invoke-WebRequest -Uri "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Credential%20Access/CA_LSASS_Dump_procdump.evtx" -OutFile "C:\labs\lab02\CA_lsass_procdump.evtx"

Get-ChildItem C:\labs\lab02\ | Select-Object Name, Length

2.1

Parse all .evtx files to a unified CSV

EvtxECmd converts binary event logs to a searchable spreadsheet

PowerShell — Admin

$ez = "C:\labs\tools\EZ"
New-Item -ItemType Directory -Force C:\labs\lab02\parsed

& "$ez\EvtxECmd\EvtxECmd.exe" -d C:\labs\lab02\ --csv C:\labs\lab02\parsed\ --csvf all_events.csv

# Count total events parsed
(Import-Csv C:\labs\lab02\parsed\all_events.csv).Count

Open in Timeline Explorer:

PowerShell

Start-Process "C:\labs\tools\EZ\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab02\parsed\all_events.csv"

ℹ️

In Timeline Explorer: pin columns TimeCreated, EventId, Channel, MapDescription, PayloadData1, PayloadData2. Use Ctrl+F to search across all columns.

Questions — answer from the event log data

Q2.1Filter Timeline Explorer to show only EventId = 4624 (successful logons). How many logon events are in the file? List every unique source IP address that appears. Which logon types (field: LogonType) are present?

💡In Timeline Explorer, click the EventId column header and filter to 4624. The source IP is usually in PayloadData3 or PayloadData4 — scroll right. Type 3 = network logon (common in lateral movement).

In LM_wmi_remote.evtx you should see: - Logon Type 3 (network) logons — WMI executes as network logon - Source IP addresses that are internal (10.x, 172.x, 192.168.x) - The account used for the logon (TargetUserName in PayloadData) Key indicator: a machine receiving Type 3 logons from other WORKSTATIONS (not servers) is unusual. Workstation-to-workstation logons are a strong lateral movement signal. In the Pass-the-Hash file: look for Logon Type 3 with AuthenticationPackage = NTLM and unusual source IPs.

Q2.2In the WMI lateral movement file, search for EventId = 4688 (process creation). What is the parent process of any cmd.exe or powershell.exe process that appears? Is this parent-child relationship normal?

💡Filter EventId to 4688. In Timeline Explorer search for "cmd.exe" or "powershell.exe" in the PayloadData columns. The parent process name appears in one of the PayloadData fields — look for "ParentProcessName" or the column labelled accordingly.

In WMI lateral movement: cmd.exe or powershell.exe spawned by WmiPrvSE.exe WmiPrvSE.exe is the WMI Provider Host — it is the process that runs commands executed remotely via WMI. Normal: WmiPrvSE.exe → cmd.exe is ONLY seen during WMI remote execution. There is no legitimate reason for WmiPrvSE.exe to spawn an interactive shell. This parent-child relationship in Event 4688 is a definitive indicator of: - WMI remote execution (T1047) - Someone ran: Invoke-WmiMethod or wmic /node:TARGET process call create "cmd.exe" Combined with the Type 3 logon from a workstation IP = lateral movement confirmed.

Q2.3Open the LSASS procdump file (CA_lsass_procdump.evtx). Search for EventId = 10 (Sysmon process access). What process is accessing LSASS? What is the GrantedAccess value? What does this value mean?

💡Sysmon Event ID 10 = ProcessAccess. Search the EventId column for 10, then look at PayloadData columns for TargetImage (should be lsass.exe) and GrantedAccess. The access mask 0x1010 or 0x1FFFFF indicates memory read access.

Common GrantedAccess values for LSASS credential theft: 0x1010 = PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ → Can read process memory — used by procdump, mimikatz 0x1FFFFF = PROCESS_ALL_ACCESS → Full access — used by aggressive tools 0x1410 = PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE → Credential dumping with handle duplication Any of these on lsass.exe from a non-system process = credential theft attempt. The SourceImage (the process doing the accessing) tells you the tool: - procdump.exe → procdump LSASS dump (T1003.001) - rundll32.exe → comsvcs.dll MiniDump technique - taskmgr.exe → Task Manager dump (user-initiated) - Any unknown process → custom credential dumper

Q2.4Load the Pass-the-Hash file. Find any EventId = 4776 events (NTLM credential validation). What username is being validated? What workstation is the source? Is the validation successful or failing?

Event 4776 is logged on the machine being authenticated TO (e.g. a DC or file server). It records the NTLM credential validation attempt. Pass-the-Hash indicators in 4776: - Status = 0x0 (success) — the hash authenticated successfully - Source workstation = the attacker's machine (not the legitimate user's workstation) - Time = unusual hours or concurrent with logon on other systems Key difference from normal auth: Normal auth: user is at their workstation, 4776 shows their workstation name PtH: attacker uses hash from a DIFFERENT machine — workstation name won't match the legitimate user's known workstation Combined with 4624 Type 3 showing NTLM (not Kerberos) = strong PtH indicator. Kerberos is preferred in AD environments — NTLM usage is itself anomalous.

Q2.5Build a mini-timeline. Using all three evidence files together in Timeline Explorer, put the following events in chronological order: (a) LSASS accessed, (b) NTLM lateral movement logon, (c) WMI remote process execution, (d) cmd.exe spawned by WmiPrvSE.exe. What does this sequence tell you about the attack chain?

The typical chain these files represent: 1. LSASS dumped (CA_lsass_procdump) — attacker steals credentials from memory 2. Pass-the-Hash (LM_pass_the_hash) — attacker authenticates to another system using stolen hash 3. WMI remote execution (LM_wmi_remote) — attacker runs commands on the new system via WMI 4. cmd.exe spawned by WmiPrvSE — the remote command executes on the destination This is one of the most common lateral movement patterns in enterprise intrusions: Credential theft → Pass-the-Hash → WMI execution → command shell ATT&CK mapping: T1003.001 (LSASS dump) → T1550.002 (Pass-the-Hash) → T1047 (WMI) → T1059.003 (cmd)

⬡ Lab 03

PowerShell Hunting

You are given event log samples containing real PowerShell attack activity. Parse them, find obfuscated commands, decode them by hand, and identify what the attacker was doing.

⏱ 45 min

🛠 EvtxECmd, Timeline Explorer, PowerShell decoder

🎯 5 questions

Get the evidence files

PowerShell — download Lab 03 evidence

New-Item -ItemType Directory -Force C:\labs\lab03

# PowerShell Empire encoded commands
Invoke-WebRequest -Uri "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Execution/exec_PowerShell_Empire_obfuscation.evtx" -OutFile "C:\labs\lab03\ps_empire.evtx"

# PowerShell download cradle (BITS/IWR)
Invoke-WebRequest -Uri "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/raw/master/Execution/exec_PowerShell_IWR_BITS.evtx" -OutFile "C:\labs\lab03\ps_download.evtx"

# Parse both to CSV
$ez = "C:\labs\tools\EZ"
& "$ez\EvtxECmd\EvtxECmd.exe" -d C:\labs\lab03\ --csv C:\labs\lab03\ --csvf ps_events.csv
Start-Process "$ez\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab03\ps_events.csv"

Questions

Q3.1In Timeline Explorer, filter to EventId = 4104 (Script Block Logging). How many script block events exist? Find any event where the PayloadData contains "EncodedCommand" or "FromBase64String". Copy the full encoded string you find.

💡In Timeline Explorer, filter EventId column = 4104. Then search (Ctrl+F) for "Encoded" or "Base64". The full script content is in the Payload or MapDescription columns — you may need to widen these columns or click a row to see the full content in the detail pane at the bottom.

Q3.2Take the base64 string from Q3.1 and decode it. What is the plaintext command? What is it trying to do?

PowerShell — base64 decoder

# Paste the base64 string from Q3.1 between the quotes below
$encoded = "PASTE_BASE64_HERE"
$decoded = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($encoded))
Write-Host $decoded

Script Block Logging (Event 4104) records the DECODED content of every PowerShell script block as it executes — BEFORE obfuscation is applied. This means: - powershell.exe -EncodedCommand [base64] → 4104 shows the decoded command - Invoke-Obfuscation scrambled code → 4104 shows what the code actually does - String concatenation tricks → 4104 shows the assembled final string An attacker who disables Script Block Logging (by modifying the GPO key) will generate Event 4719 (audit policy changed) — which itself is evidence. The decoded Empire agent commands typically show: - Download cradle: Invoke-WebRequest / IEX (New-Object Net.WebClient).DownloadString() - C2 communication: encoded HTTP requests to attacker's server - Enumeration: Get-Process, Get-LocalUser, ipconfig, net commands

Q3.3In the download cradle file (ps_download.evtx), find the URL that PowerShell attempted to connect to. What domain or IP is it contacting? What method is being used (Invoke-WebRequest, BITS, WebClient)?

💡Filter to EventId 4104 in the download file. Look for strings containing "http", "Invoke-WebRequest", "Net.WebClient", or "Start-BitsTransfer" in the payload data.

Q3.4Find EventId = 400 (PowerShell engine started) events across both files. What does the HostApplication field show for each? Does any session show it was launched with -NonInteractive, -WindowStyle Hidden, or -ExecutionPolicy Bypass flags? Why are these flags significant?

These flags are almost exclusively used by attackers or automated tools: -WindowStyle Hidden: hides the PowerShell window from the user → Attacker runs commands invisibly in the background -NonInteractive: disables user interaction prompts → Automated execution without a real user present -ExecutionPolicy Bypass: overrides the script execution policy → Allows running unsigned scripts when policy would block it -EncodedCommand: base64 encodes the command → Hides the command from casual log inspection Finding these in Event 400's HostApplication field proves: 1. PowerShell was run by an attacker or automation, not interactively by a user 2. The attacker was deliberately hiding their activity 3. Combined with encoded content in 4104 = deliberate obfuscation Any alert system should fire on: powershell.exe with -WindowStyle Hidden This combination appears in virtually no legitimate software.

⬡ Lab 04

Prefetch — Prove It Ran

You are given a collection of real Prefetch files extracted from a compromised system. Use PECmd to parse them and answer specific questions about what ran, when, and from where — including tools that were deleted after execution.

⏱ 45 min

🛠 PECmd, Timeline Explorer

🎯 5 questions

Get the evidence files

💾

Prefetch files — from "The Stolen Szechuan Sauce" DFIR challenge

https://github.com/randomaccess3/notevil/raw/master/CyberDefenders-Challenges/szechuan-sauce/Prefetch.zip

Format: ZIP containing .pf files | Real incident Prefetch collection

Save to: C:\labs\lab04\Prefetch.zip → extract to C:\labs\lab04\pf\

⚠️

If the above URL is unavailable, use the CyberDefenders challenge directly at cyberdefenders.org/blueteam-ctf-challenges/szechuan-sauce (free registration). Download the challenge ZIP and locate the Prefetch folder inside it.

PowerShell — download and extract

New-Item -ItemType Directory -Force C:\labs\lab04\pf

# If direct download works:
Invoke-WebRequest -Uri "https://github.com/randomaccess3/notevil/raw/master/CyberDefenders-Challenges/szechuan-sauce/Prefetch.zip" -OutFile C:\labs\lab04\Prefetch.zip
Expand-Archive C:\labs\lab04\Prefetch.zip -Destination C:\labs\lab04\pf\ -Force

# Count .pf files extracted
(Get-ChildItem C:\labs\lab04\pf\ -Recurse -Filter "*.pf").Count

4.1

Parse all Prefetch files with PECmd

Generates a CSV with execution times, run counts, and file load lists

PowerShell — Admin

$ez = "C:\labs\tools\EZ"
& "$ez\PECmd.exe" -d C:\labs\lab04\pf --csv C:\labs\lab04\ --csvf prefetch.csv
Start-Process "$ez\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab04\prefetch.csv"

Questions — answer from the Prefetch data

Q4.1How many total Prefetch entries are in the collection? What is the date range — what is the earliest LastRun and the most recent LastRun timestamp? This tells you how long the system has been in use (or how long since it was last wiped).

💡In Timeline Explorer, sort the LastRun column ascending to find the earliest, descending to find the most recent.

Q4.2Filter the source path column (SourcePath or ExecutablePath) to show entries where the executable ran from a suspicious path — anything in \TEMP\, \APPDATA\, \PROGRAMDATA\, \USERS\PUBLIC\, or the root of \USERS\. List every suspicious execution you find with its path and LastRun timestamp.

💡In Timeline Explorer, right-click the path column → Filter. Type "temp" to find all Temp executions, then "appdata", etc. Keep a running list.

Legitimate software is installed in: C:\Windows\, C:\Program Files\, C:\Program Files (x86)\ Malware avoids these because: - Program Files requires admin to write to → may trigger UAC prompt - C:\Windows\ is heavily monitored - Temp and AppData are writable by standard users → no UAC needed Finding executables run from Temp or AppData = immediate red flag. The executable name may also masquerade as a legitimate tool: svchost.exe in C:\Users\Public\ ← NOT legitimate (real one is in System32) explorer.exe in C:\Temp\ ← NOT legitimate csrss.exe anywhere outside System32 ← NOT legitimate Always check: does the path match where this executable SHOULD live?

Q4.3Find any Prefetch entries for known attacker tools: MIMIKATZ.EXE, PROCDUMP.EXE, PSEXEC.EXE, METERPRETER, COBALT, BEACON, WMIEXEC, or any name that seems obfuscated (random characters, numbers replacing letters). List every hit.

💡Use Ctrl+F in Timeline Explorer to search for each tool name. Also look for names with unusual character substitutions like svch0st, lsas, etc. — these appear in some samples.

Q4.4Click on the Prefetch entry with the highest RunCount (ran most times). In the PECmd output, the "FilesLoaded" column lists files and directories the executable accessed. Does the most-run program access any unusual directories or files? What does high RunCount suggest about this program's role?

Q4.5Now verify: do the suspicious executables from Q4.2 and Q4.3 still exist on the file system? Using the source path from Prefetch, check if the file is present. What does it mean forensically when a Prefetch entry exists but the file does not?

PowerShell — check if files still exist

# Replace with each suspicious path from your Q4.2 / Q4.3 findings
$paths = @(
    "C:\path\to\suspicious1.exe",
    "C:\path\to\suspicious2.exe"
)
$paths | ForEach-Object {
    [PSCustomObject]@{
        Path   = $_
        Exists = Test-Path $_
    }
}

When a Prefetch .pf file exists but the executable does not: The program DEFINITELY ran on this system. The executable was deleted AFTER it ran. Prefetch proves execution REGARDLESS of whether the file is still present. This is one of the most powerful aspects of Prefetch forensics: An attacker who runs a tool then deletes it to cover their tracks CANNOT delete the Prefetch entry without also deleting all .pf files — which would itself be suspicious (Event 4688 for deletion command, or an empty C:\Windows\Prefetch\ folder is a red flag). In your Prefetch report, file-gone entries should be flagged as: "EVIDENCE OF DELETED TOOL — execution confirmed, binary not recoverable from disk"

⬡ Lab 05

File System & Timestamps

You are given a real $MFT image from a challenge. Parse it with MFTECmd and investigate the file system for timestomped files, recently created executables, and file operation patterns that reveal attacker activity.

⏱ 60 min

🛠 MFTECmd, Timeline Explorer

🎯 5 questions

Get the evidence file

💾

$MFT image — from "The Stolen Szechuan Sauce" DFIR challenge (same as Lab 04)

cyberdefenders.org/blueteam-ctf-challenges/szechuan-sauce

Free registration required | Download the challenge ZIP | Locate the $MFT file inside

Save MFT file to: C:\labs\lab05\MFT

ℹ️

The "$MFT" file has no extension — this is normal. MFTECmd accepts it without an extension. If you downloaded this in Lab 04, the file may already be in your challenge folder. The MFT file is typically 50–200 MB.

5.1

Parse the $MFT with MFTECmd

Extracts all file metadata including both $SI and $FN timestamp sets

PowerShell — Admin

$ez = "C:\labs\tools\EZ"
New-Item -ItemType Directory -Force C:\labs\lab05\parsed

& "$ez\MFTECmd.exe" -f C:\labs\lab05\MFT --csv C:\labs\lab05\parsed\ --csvf mft.csv

# How many entries?
Write-Host "MFT entries: $((Import-Csv C:\labs\lab05\parsed\mft.csv).Count)"

Start-Process "$ez\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab05\parsed\mft.csv"

Questions — answer from the MFT data

Q5.1In Timeline Explorer, filter to show only files with extension .exe. Sort by SI_Created0x10 (Standard Information Created timestamp) descending. What are the 5 most recently created executables? What are their full paths?

💡In Timeline Explorer: use the column filter to show only rows where Extension = .exe. Then sort SI_Created0x10 descending. The ParentPath column gives the directory.

Q5.2Timestomping detection: find files where the SI_Created0x10 timestamp is significantly earlier than the FN_Created0x30 timestamp (more than 7 days difference). These files have been timestomped. How many do you find? What are their names and what is the gap?

PowerShell — detect timestomped files from MFT CSV

Import-Csv C:\labs\lab05\parsed\mft.csv |
  Where-Object {
    $_.SI_Created0x10 -ne '' -and $_.FN_Created0x30 -ne '' -and
    $_.IsDirectory -eq 'False' -and
    [datetime]$_.SI_Created0x10 -lt ([datetime]$_.FN_Created0x30).AddDays(-30)
  } |
  Select-Object FileName, ParentPath,
    @{N='SI_Created';E={$_.SI_Created0x10}},
    @{N='FN_Created';E={$_.FN_Created0x30}},
    @{N='DiffDays';E={
      ([datetime]$_.FN_Created0x30 - [datetime]$_.SI_Created0x10).Days
    }} |
  Sort-Object DiffDays -Descending |
  Select-Object -First 20 |
  Format-Table -AutoSize

When SI_Created is much EARLIER than FN_Created: The file was created recently (FN = kernel truth) but its visible timestamp was changed backwards (SI = user-modifiable) to appear old. Common attacker motivation: - Make malware appear to be from Windows XP era (2001-2008) to look like system files - Blend in with old legitimate software - Avoid "recently modified files" filters during initial triage The SI timestamp is what appears in Windows Explorer and most tools. Only MFT analysis with dual timestamp comparison reveals the deception. A difference of more than 2 years between SI and FN is very suspicious. File system events (like file being created) should produce matching SI and FN. Any discrepancy > a few seconds warrants investigation. Note: some legitimate software (OS installers, system image restores) can cause timestamp discrepancies — always check file path and name for context.

Q5.3Filter to show files in the \Windows\Temp\ or \Users\ directories with .exe, .ps1, .bat, or .vbs extensions that were created during the apparent attack window (use the timestamps from Lab 04 to define the window). List every file found.

Q5.4Find all .zip, .rar, or .7z files in the MFT. Note their paths and creation timestamps. Are any located in unusual places (not Downloads, not Desktop)? An archive in \ProgramData\ or \Temp\ is a strong data-staging indicator — did you find any?

⬡ Lab 06

Browser & LNK Evidence

You are given a real browser history SQLite database and a collection of LNK files from a suspect workstation. Answer specific questions about what was downloaded, what files were opened, and whether any access was from removable media.

⏱ 45 min

🛠 DB Browser for SQLite, LECmd, Timeline Explorer

🎯 5 questions

Get the evidence files

🌐

Chrome History & LNK files — from "The Stolen Szechuan Sauce" challenge (same download)

cyberdefenders.org/blueteam-ctf-challenges/szechuan-sauce

Locate: History file (no extension, in Chrome profile folder) and any .lnk files in the challenge ZIP

Save History to: C:\labs\lab06\Chrome_History | LNK files to: C:\labs\lab06\lnk\

6.1

Open Chrome History in DB Browser for SQLite

Chrome history is a standard SQLite database — query it directly with SQL

Open DB Browser for SQLite
File → Open Database → browse to C:\labs\lab06\Chrome_History
Click the Browse Data tab to see tables: urls, visits, downloads
Click the Execute SQL tab to run custom queries

ℹ️

Chrome timestamp formula: Chrome stores times as microseconds since Jan 1 1601. In SQL: datetime(field/1000000-11644473600,'unixepoch') converts to readable UTC.

Questions — answer from the browser and LNK data

Q6.1Run this SQL query to get the top 20 most visited sites. What are the top 3? Is there anything unusual — hacking tools, paste sites (pastebin.com, hastebin), file sharing (mega.nz, anonfiles), or known malware distribution domains?

SQL — paste into DB Browser Execute SQL tab

SELECT url, title, visit_count,
       datetime(last_visit_time/1000000-11644473600,'unixepoch') AS last_visit
FROM urls
ORDER BY visit_count DESC
LIMIT 20;

Q6.2Query the downloads table. List every downloaded file — filename, source URL, download timestamp, and file size. Are any .exe, .zip, .ps1, or .iso files present? Where was each downloaded from?

SQL — download history

SELECT datetime(start_time/1000000-11644473600,'unixepoch') AS download_time,
       current_path,
       tab_url,
       received_bytes,
       state
FROM downloads
ORDER BY start_time DESC;

Q6.3Now parse the LNK files with LECmd. How many LNK files exist? Find any where the DriveType column shows Removable — these prove files were accessed from a USB drive. List the full target path from any removable drive LNK entries.

PowerShell

$ez = "C:\labs\tools\EZ"
& "$ez\LECmd.exe" -d C:\labs\lab06\lnk\ --csv C:\labs\lab06\ --csvf lnk.csv
Start-Process "$ez\TimelineExplorer\Timeline Explorer.exe" "C:\labs\lab06\lnk.csv"

An LNK file with DriveType = Removable proves: 1. A USB drive was connected to this machine 2. The user (or attacker) opened a file from it 3. The VolumeSerialNumber identifies the SPECIFIC USB device (if you find the device, you can match it forensically) This is how you prove data exfiltration to USB: "On [date/time], a file named [filename] was accessed from removable drive [letter] with volume serial [serial]. This proves a USB device was present and data was accessed." Even if the USB drive is gone, the LNK file on the machine proves it was there. The VolumeSerialNumber can match a specific drive if you later recover it.

⬡ Lab 07

Memory Analysis

You are given a real Windows memory dump from a compromised system. Use Volatility 3 to analyse running processes, find injected code, extract network connections, and identify credential theft activity.

⏱ 90 min

🛠 Volatility 3

🎯 6 questions

Get the evidence file

🧠

Windows Memory Image — CyberDefenders "Obfuscated" Challenge

cyberdefenders.org/blueteam-ctf-challenges/obfuscated

Free registration | Download challenge ZIP | Contains a .raw or .vmem memory image | ~500MB–2GB

Save to: C:\labs\lab07\memory.raw (rename if needed)

⚠️

Memory images are large (500MB–4GB). Ensure you have sufficient disk space. Download time may be 10–30 minutes on a standard connection. Alternative: use the "MemLabs" free memory challenges from github.com/stuxnet999/MemLabs — Lab01 is a good starting point.

7.1

Run Volatility 3 core modules

Start with the essential modules — each answers different investigation questions

PowerShell — Admin — run these one at a time

$ram = "C:\labs\lab07\memory.raw"
$out = "C:\labs\lab07\vol_out"
New-Item -ItemType Directory -Force $out

# 1. Identify Windows version (needed for correct symbol selection)
vol -f $ram windows.info 2>&1 | Out-File "$out\01_info.txt"

# 2. Full process list with PIDs and parent PIDs
vol -f $ram windows.pslist 2>&1 | Out-File "$out\02_pslist.txt"

# 3. Process tree showing parent-child relationships
vol -f $ram windows.pstree 2>&1 | Out-File "$out\03_pstree.txt"

# 4. Command lines for every process
vol -f $ram windows.cmdline 2>&1 | Out-File "$out\04_cmdline.txt"

# 5. Active and recently closed network connections
vol -f $ram windows.netscan 2>&1 | Out-File "$out\05_netscan.txt"

# 6. Scan for injected code (RWX memory regions)
vol -f $ram windows.malfind 2>&1 | Out-File "$out\06_malfind.txt"

Write-Host "All modules complete. Review files in $out"

ℹ️

Each module may take 2–10 minutes on a large image. Run them sequentially. If a module fails, note the error message — it often indicates a symbol download is needed: vol -f [image] windows.info will trigger an automatic symbol download on first run.

Questions — answer from Volatility output

Q7.1Open 03_pstree.txt. Find any process where the parent-child relationship is anomalous. Specifically: does any cmd.exe or powershell.exe have an unexpected parent? Does lsass.exe have the correct parent (wininit.exe)? List every anomaly you find.

💡Normal: explorer.exe → cmd.exe, services.exe → svchost.exe, wininit.exe → lsass.exe. Suspicious: winword.exe → powershell.exe (macro), WmiPrvSE.exe → cmd.exe (WMI remote exec), unknown process → cmd.exe.

Q7.2Open 04_cmdline.txt. Find every process that was launched with suspicious command-line arguments — specifically: base64 encoded strings, -WindowStyle Hidden, -ExecutionPolicy Bypass, -EncodedCommand, or download URLs. List the full command line for each.

Q7.3Open 05_netscan.txt. List every ESTABLISHED connection. For each: which process owns it, what is the remote IP and port, and is the remote IP a public (internet) or private (internal) address? Flag any process that should not have network connections (e.g. notepad.exe, calc.exe, or any process with an unusual name).

Legitimate ESTABLISHED connections you'd expect to see: chrome.exe / msedge.exe → 443 (HTTPS browsing) svchost.exe → Microsoft update/telemetry IPs lsass.exe → domain controller IPs (Kerberos) outlook.exe → mail server IPs Immediately suspicious: Any process → port 4444 (Metasploit default) Any process → port 1337, 8080, 9999 (common C2 ports) Unusual process (calc.exe, notepad.exe) → ANY external IP powershell.exe → external IP (unless known WSUS/management server) cmd.exe → any network connection Unknown process name → any external IP Port 443 is not automatically safe — malware uses HTTPS C2 to blend in. Check the remote IP on VirusTotal or AbuseIPDB after the lab to see if it's known malicious.

Q7.4Open 06_malfind.txt. How many suspicious memory regions were flagged? For any flagged region, what process does it appear in? Copy the hex dump shown — do you see any readable strings (MZ header = PE executable, or ASCII commands)?

💡MZ header in the hex dump (bytes 4D 5A) means a PE executable (Windows .exe or .dll) has been injected into memory. This is process injection (T1055). The injected code is running inside a legitimate process to hide from process lists.

Q7.5Run this additional Volatility command to extract cached password hashes from the registry in memory. What hashes are returned? (Note: in a real case these would be used to attempt offline cracking — for this lab just document what accounts and hash types are present.)

PowerShell

$ram = "C:\labs\lab07\memory.raw"
vol -f $ram windows.hashdump 2>&1 | Out-File "C:\labs\lab07\vol_out\07_hashes.txt"
Get-Content "C:\labs\lab07\vol_out\07_hashes.txt"

⬡ Lab 08

Full Incident — From Scratch

You are given the complete evidence package from the "The Stolen Szechuan Sauce" DFIR challenge — a disk image, event logs, registry hives, browser history, and more. Answer 8 specific questions that together tell the full story of what happened.

⏱ 3–4 hours

🛠 All tools from previous labs

🎯 8 questions — full investigation

Get the evidence package

📦

The Stolen Szechuan Sauce — CyberDefenders DFIR Challenge

cyberdefenders.org/blueteam-ctf-challenges/szechuan-sauce

Free registration required | Complete evidence package: disk image, memory dump, event logs, registry, browser data

Extract everything to: C:\labs\lab08\evidence\

✅

Why this challenge? "The Stolen Szechuan Sauce" is a free, publicly available DFIR challenge used in professional forensics training. It contains a realistic, multi-artefact Windows forensic scenario with verified correct answers available after completion. It is specifically designed for hands-on practice with real tools.

📝

Investigation brief: A user on a corporate Windows workstation is suspected of exfiltrating sensitive data ("Szechuan Sauce" recipe). Your job: determine exactly what happened, how they did it, what was taken, and when. Answer each question with a specific artefact citation — tool used, file examined, exact value found.

Investigation Questions — 8 specific findings

Q8.1What is the hostname of the workstation? What version of Windows is it running? What is the timezone configured on the machine? (Timezone is critical — all your timestamps must be mentally adjusted if not UTC.)

💡Check the SYSTEM registry hive: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName for hostname. SYSTEM\CurrentControlSet\Control\TimeZoneInformation for timezone. Or check Volatility windows.info output from any memory image.

Q8.2What user accounts exist on the workstation? Which account was the primary active user? When was the last interactive logon for that account? (Check SAM hive and Security event log.)

💡RECmd on the SAM hive will list all local accounts. The Security event log 4624 events with LogonType=2 show interactive logons. The most recent one before the incident identifies the active user session.

Q8.3What was the first suspicious executable to run on the machine? What path did it run from? What time did it first execute? (Use Prefetch as your primary source — Prefetch timestamps are often more reliable than event logs for first-execution times.)

Q8.4What persistence mechanism did the attacker use? Provide the exact registry key path, value name, and the full command it executes. When was this persistence entry created?

Q8.5What data did the attacker access or steal? Look at RecentDocs, LNK files, and browser downloads together. Identify the specific file(s) that were accessed, their paths, and when they were accessed.

Q8.6Was there any evidence of data exfiltration — either to an external URL (browser/event logs) or to a USB drive (LNK DriveType = Removable, Shellbags with drive letters)? Provide the specific artefact that proves it.

Q8.7Build a chronological timeline of the 8 most significant events in this incident. For each event: exact timestamp, what happened, and which specific artefact (file + tool) proves it. Use the format: [timestamp] | [event] | [artefact evidence]

Q8.8Write a one-paragraph Executive Summary of this incident — suitable for a non-technical manager. No jargon, no tool names, no event IDs. Just: what happened, what was taken, and what the impact was. Then write one paragraph of Recommendations — what should be done to prevent this in future.

🎓

After completing Lab 08: CyberDefenders publishes the official answer walkthrough for The Stolen Szechuan Sauce after you submit your answers on their platform. Compare your findings against the official solution. Any discrepancies reveal gaps in your technique — revisit the relevant earlier lab to strengthen that skill.

More Evidence-Based Challenges

Challenge	Platform	Artefacts	Difficulty
The Stolen Szechuan Sauce	CyberDefenders	Disk, memory, registry, browser	Beginner–Intermediate
AfricanFalls	CyberDefenders	Disk image, Windows forensics	Intermediate
MemLabs Lab01–06	GitHub/MemLabs	Memory dumps only	Beginner → Advanced
The Report	BlueTeamLabs Online	Event logs, Prefetch, LNK	Intermediate
Sticky Situation	BlueTeamLabs Online	Registry, event logs	Intermediate
EVTX-ATTACK-SAMPLES	GitHub (sbousseaden)	Real attack .evtx files by technique	All levels
Magnet CTF Archives	magnetforensics.com	Mobile, disk, memory, cloud	Intermediate–Advanced