Evidence Intake & Hash Verification
Receive a USB drive image for a live case, identify it by its contents, verify it against the field examiner's hashes, catch a tampered working copy, and take in new evidence with an unbroken chain of custody.
Skills you will practice
- SHA-256 and MD5 hashing
- Magic-byte file identification
- Hex dumps with xxd
- strings and grep
- Byte-level comparison with cmp
- Checksum verification
- Chain of custody
- Linux file permissions
The scenario
You are the intake analyst on shift at a digital forensics lab. A USB drive was imaged in the field this morning for Case 2026-0412, and the image has just arrived. Before anyone analyzes it, your job is to confirm the evidence is exactly what the field examiner captured, catch any problems, and document everything. Start by getting your bearings.
What you will do
- Orient yourself in the case workspace6 steps
Confirm where you are · Read the intake checklist · Move into the case folder · List everything, with details · …
- Identify the evidence from its contents10 steps
Check the file type by its magic bytes · Which file system? · Record the exact size and timestamps · Confirm the original is read-only · …
- Verify integrity against the acquisition hashes7 steps
Compute the MD5 hash · Compute the SHA-256 hash · Do the hashes match? · Save the hash in checksum format · …
- Catch a tampered working copy8 steps
Hash the working copy · Is the copy good? · Find the first difference · Where is the change? · …
- Intake new evidence from the field8 steps
Receive the file · List what arrived · Identify the new file · Hash the new evidence · …
How this lab works
A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.
A file browser where you can place evidence into the lab, either the file provided or one of your own.
Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.
Progress saves after every step. Close the tab and come back later; your files and answers are waiting.