thinQtankLABS
thinQtank Learning labs

Hands-on labs that actually run.

Real consoles and real files, right in your browser. Every lab walks you through a realistic scenario step by step, explains why each step matters, and saves your progress so you can pick up exactly where you left off.

  • Nothing to install
  • Beginner to expert
  • Reset any step and try again
analyst@forensics-ws: ~/cases/case-0412
$ sha256sum evidence.img
77e5393065b1217eb21a7fce87d7821291c7bc2…  evidence.img
$ sha256sum working/evidence_copy.img
30302fe6634ece1fd1db5329da7cc10e5c133ed…  working/evidence_copy.img
$ cmp evidence.img working/evidence_copy.img
evidence.img working/evidence_copy.img differ: byte 2195, line 5
$ strings working/evidence_copy.img | grep Amount
% Amount due: 98,200.00 USD   Terms: wire transfer only
$ 
Step 26 complete. One changed byte turned 48,200 into 98,200. Rule 4 just caught a tampered copy.
  • A real consoleType real commands. They run against real files.
  • 20+ guided stepsEvery step explains the why, not just the what.
  • Reset anythingUndo a step, a task, or the whole lab.
  • Progress that savesLeave mid-lab and resume right where you were.
How it works

Learn it by doing it

Choose a lab

Browse by category and difficulty. Each lab page shows its scenario, tasks and the skills you will practice before you start.

Work the scenario

Step cards guide you on the left while you work in a live console and file browser on the right. The lab checks your work as you go.

Come back anytime

Your progress is saved to your account step by step. Reset a step to try it again, or reset the whole lab and start fresh.

Featured lab

Evidence Intake & Hash Verification

Receive a USB drive image for a live case, identify it by its contents, verify it against the field examiner's hashes, catch a tampered working copy, and take in new evidence with an unbroken chain of custody.

  • Hash files, read raw bytes and compare evidence with real Linux tools
  • Catch a tampered working copy down to the exact byte
  • Place new evidence into the lab and document its chain of custody
View the lab Beginner 39 steps · about 60 min

Ready to get your hands dirty?

Open a lab in your browser. No installs, no virtual machines to set up.

Browse the labs