FG09 — Create and verify a forensic container

C01 Create an isolated practice workspace

Application tutorial C01 · Supports slides 2–4; no separate deck slide

set -euo pipefail
for cmd in stat sha256sum tar getfacl \
  getfattr findmnt mktemp; do
  command -v "$cmd" >/dev/null || exit 1
done
lab=$(mktemp -d "$HOME/ContainerLab.XXXXXXXX")
mkdir "$lab/source" "$lab/records" \
  "$lab/received"
printf 'Synthetic forensic container lab\n' \
  > "$lab/source/evidence.log"
cd "$lab/source"

C02 Record the source environment

Application tutorial C02 · Supports slides 2–4; no separate deck slide

{
  date -u --iso-8601=ns
  cat /etc/os-release
  uname -a
  findmnt -T . \
    -o TARGET,SOURCE,FSTYPE,OPTIONS
  stat --version
  tar --version
} > environment.txt
cat environment.txt

C03 Capture metadata BEFORE hashing

Application tutorial C03 · Supports slides 2–4; no separate deck slide

# Remain in "$lab/source"
stat evidence.log > source-state.txt
getfacl -p evidence.log > evidence.acl
getfattr -d -m- evidence.log \
  > evidence.xattrs
cat source-state.txt
cat evidence.acl
cat evidence.xattrs

C04 Hash content and record the post-read state

Application tutorial C04 · Supports slides 2–4; no separate deck slide

sha256sum evidence.log > evidence.sha256
stat evidence.log > after-hash-state.txt
cat evidence.sha256
rc=0
diff -u source-state.txt \
  after-hash-state.txt || rc=$?
# diff: 0 = equal, 1 = differences
# Greater than 1 = comparison error
if (( rc > 1 )); then exit "$rc"; fi

C05 Define exactly what enters the container

Application tutorial C05 · Supports slides 2–4; no separate deck slide

ls -l -- \
  evidence.log \
  evidence.sha256 \
  source-state.txt \
  after-hash-state.txt \
  environment.txt \
  evidence.acl \
  evidence.xattrs

C06 Create the forensic file container

Application tutorial C06 · Supports slides 2–4; no separate deck slide

# Working directory: "$lab/source"
tar --format=pax --acls --xattrs \
  --numeric-owner --atime-preserve=system \
  -czf "$lab/evidence.tar.gz" \
  evidence.log evidence.sha256 \
  source-state.txt after-hash-state.txt \
  environment.txt evidence.acl evidence.xattrs

C07 List the archive before transfer

Application tutorial C07 · Supports slides 2–4; no separate deck slide

cd "$lab"
tar -tzf evidence.tar.gz \
  > records/archive-members.txt
cat records/archive-members.txt

C08 Hash the finished container

Application tutorial C08 · Supports slides 2–4; no separate deck slide

sha256sum evidence.tar.gz \
  > evidence.tar.gz.sha256
cat evidence.tar.gz.sha256
date -u --iso-8601=ns
# Retain an independent receipt BEFORE transfer:
# case/run ID, filename, complete SHA-256,
# sender, recipient, UTC time, scope and method

C09 Transfer the archive to Windows

Application tutorial C09 · Supports slides 2–4; no separate deck slide

# Obtain the real account, host and destination.
# This example contains placeholders.
scp -p \
  "$lab/evidence.tar.gz" \
  "$lab/evidence.tar.gz.sha256" \
  analyst@lab.example:/cases/lab409/

C10 Verify receipt on Windows

Application tutorial C10 · Supports slides 2–4; no separate deck slide

$archive = Read-Host 'Received archive path'
$expected = (Read-Host 'Trusted SHA256').Trim()
if ($expected -notmatch '^[0-9A-Fa-f]{64}$') {
  throw 'Expected 64 hexadecimal characters'
}
$actual = (Get-FileHash -LiteralPath $archive `
  -Algorithm SHA256).Hash
if ($actual -ine $expected) {
  throw 'Container hash mismatch'
}
'Container bytes match the supplied receipt'

C11 Rehearse receipt verification on Linux

Application tutorial C11 · Supports slides 2–4; no separate deck slide

cp -- "$lab/evidence.tar.gz" "$lab/received/"
cp -- "$lab/evidence.tar.gz.sha256" \
  "$lab/received/"
cd "$lab/received"
sha256sum -c evidence.tar.gz.sha256
sha256sum evidence.tar.gz

C12 Extract into a new Linux directory

Application tutorial C12 · Supports slides 2–4; no separate deck slide

cd "$lab/received"
tar -tzf evidence.tar.gz
mkdir extracted
tar --acls --xattrs --no-same-owner \
  -xzf evidence.tar.gz -C extracted
cd extracted

C13 Verify extracted content before analysis

Application tutorial C13 · Supports slides 2–4; no separate deck slide

stat evidence.log \
  > "$lab/records/destination-before-hash.txt"
sha256sum -c evidence.sha256
stat evidence.log \
  > "$lab/records/destination-after-hash.txt"
cat "$lab/records/destination-before-hash.txt"

C14 Compare timestamps and identity

Application tutorial C14 · Supports slides 2–4; no separate deck slide

cat source-state.txt
cat "$lab/records/destination-before-hash.txt"
rc=0
diff -u source-state.txt \
  "$lab/records/destination-before-hash.txt" \
  || rc=$?
if (( rc > 1 )); then exit "$rc"; fi

C15 Compare ACLs and extended attributes

Application tutorial C15 · Supports slides 2–4; no separate deck slide

getfacl -p evidence.log \
  > "$lab/records/destination.acl"
getfattr -d -m- evidence.log \
  > "$lab/records/destination.xattrs"
rc=0
diff -u evidence.acl \
  "$lab/records/destination.acl" || rc=$?
if (( rc > 1 )); then exit "$rc"; fi
rc=0
diff -u evidence.xattrs \
  "$lab/records/destination.xattrs" || rc=$?
if (( rc > 1 )); then exit "$rc"; fi

C16 Record a bounded preservation conclusion

Application tutorial C16 · Supports slides 2–4; no separate deck slide

Container digest matched trusted receipt: ____
Seven named members accounted for: ____
Extracted evidence hash matched: ____
Metadata compared and differences explained: ____
Unverified steps and limitations recorded: ____

Student submission and primary references

For each command ID, record your actual command, UTC time, tool/OS versions, filesystem and policy, before/after fields, full hashes, screenshot and raw-log filenames, and any warning or skipped step. Explain why the observed result supports the stated conclusion and what it cannot establish. Keep the source, container, receipt and extracted working copy distinguishable.

Guttman, B., White, D. R., & Walraven, T. (2022). Digital evidence preservation: Considerations for evidence handlers (NIST IR 8387). https://doi.org/10.6028/NIST.IR.8387

Free Software Foundation. (n.d.). GNU tar manual. https://www.gnu.org/software/tar/manual/tar.html

Free Software Foundation. (n.d.). GNU Coreutils manual. https://www.gnu.org/software/coreutils/manual/coreutils.html

Linux man-pages project. (n.d.). inode(7). https://man7.org/linux/man-pages/man7/inode.7.html

Microsoft. (n.d.). File times. https://learn.microsoft.com/en-us/windows/win32/sysinfo/file-times

Microsoft. (n.d.). Robocopy. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy

OpenBSD Project. (n.d.). scp(1). https://man.openbsd.org/scp.1

Zimmerman, E. (n.d.). MFTECmd. https://github.com/EricZimmerman/MFTECmd

Local sources: the two validation workbooks; Linux_Forensic_Time_Validator.sh; the controlled Windows procedure and automated harness; saved MFT/USN CSVs; and QA/Native_Container_20260920. Original captures remain unchanged in Source. The source map identifies each image and command ID.

Preservation principle: Preserve what you can; document what you cannot preserve; verify every transition.

Email qualification: the comparison concerns unverified loose-file attachments. MIME can carry optional date parameters, but actual sender/receiver support must be checked. A verified intact archive can use an authorized transport with handling records. See https://www.rfc-editor.org/rfc/rfc2183.html.

Student downloads

• Complete FG09 Student Kit (v23)
• Editable student field guide (v23)
• Linux validation script
• Windows validation harness
• Windows controlled procedure, steps 00–10
• Observation worksheet
• PacketParsing.pcapng · http-google101.pcapng

The packet captures support the packet-parsing companion; the timestamp experiments use synthetic files. The Windows harness and the controlled 00–10 procedure are separate sources with different step numbers.

1. Container workflow · 2. Linux validation · 3. Windows validation · 4. Create and verify your container