Field guide companion

Windows Robocopy lab

FG09 · v23

1. Container workflow · 2. Linux validation · 3. Windows validation · 4. Create and verify your container

Alerts to Answers Analyst Field Guide — Review Draft — v22 companion

Introduction

Robocopy is a Windows tool for copying files and folders. It is useful when a folder tree is large, a transfer is interrupted, or a graphical copy is difficult to troubleshoot. Its log records what was copied, skipped, or failed (Microsoft, 2025).

In forensic work, Robocopy can help transfer selected files or already acquired material. A copy log and a separate content check help explain what reached the destination. Robocopy is not a forensic disk-imaging tool: it does not acquire deleted files or unallocated space (Guttman et al., 2022, pp. 1, 6–8).

1 Learn one skill at a time

Stage	Your task
Crawl	Identify source and destination; preview a copy.
Walk	Make a logged copy and repeat it.
Run	Compare both copies using SHA-256.

Before you begin

Use PowerShell 7.6 LTS or a later supported stable 7.x release on Windows. Launch pwsh, then check $PSVersionTable.PSVersion. Use a writable local class folder kept outside temporary storage and automatic cloud synchronization. Extract the supplied materials ZIP. Open PowerShell in the extracted folder that contains Student, and keep that session open throughout the exercise. Use the scripts under your classroom's normal policy; this lab does not require administrator rights or an execution-policy change.

The four scripts require PowerShell 7.6 or later; this edition is tested on 7.6.6. Microsoft still ties Windows PowerShell 5.1 support to Windows support; this guide does not assume its removal (Microsoft, 2026b).

The HTML guide provides Copy code buttons. The Word guide is the reading and printing version. Copy the whole command block, including any continued lines. A backtick at the end of a line continues the command; do not add spaces after it. Run one block at a time and stop if it reports an error.

Practice boundary

All practice files are synthetic. Use the folders made by the setup script. Do not substitute project archives or real evidence. The copy step writes to Destination and Logs; the comparison step reads both copies and reports to the screen. A separate saving step writes only to Records. No supplied script deletes files.

For real evidence, follow the approved acquisition, source-protection, and custody procedures. Reading a live source can affect its state; these scripts do not provide write protection. Keep both copies stable during verification (Guttman et al., 2022, pp. 1, 6–8).

NISTIR 8387 guides the preservation principles used here. It is not a complete acquisition procedure, and this classroom kit is not NIST-certified. An admissibility decision cannot be inferred from a PASS label (Guttman et al., 2022, pp. 1, 6).

Chapter alignment

Proposed companion to Chapter 7, Digital Forensics and Incident Response, with supporting use in Chapter 9, Operating the Platform. No official guide or lab number has been assigned.

2 Crawl Prepare the practice files

The first script creates a unique practice folder inside your current class folder. It makes three files and one empty folder in Source. It also creates Logs and Records and hashes the source files into Records\source-baseline.json before any copy. It does not create Destination or copy any files.

$lab = & '.\Student\New-RobocopyLab.ps1'
$src = Join-Path $lab 'Source'
$dst = Join-Path $lab 'Destination'
$baseline = Join-Path $lab 'Records\source-baseline.json'

$lab, $src, and $dst are variables: short names for the full paths. The script prints the lab path. Record it in your worksheet.

Name	Meaning
Source	Files to read. These remain in place after copying.
Destination	Folder that will receive the copy.
Logs and Records	Copy logs, original hashes, and saved checks, outside both copies.

Expected source files: Case Notes\notes.txt, Exports\events.log, and Exports\results.csv. Source also contains EmptyFolder. The fixture has no links or special files.

Before copying: give the printed baseline SHA-256, lab ID, and UTC time to your instructor for a receipt you cannot edit. Keep the JSON baseline. A hash stored only beside editable evidence can itself be replaced; separate custody matters (Guttman et al., 2022, pp. 7, 11).

3 Crawl Preview the direction

The robocopy line reads from $src toward $dst, includes subfolders, and lists planned work only. The surrounding block keeps PowerShell error handling local because Robocopy uses some nonzero codes for successful work.

& {
  $PSNativeCommandUseErrorActionPreference = $false
  robocopy "$src" "$dst" /E /L /R:2 /W:2
}

/E includes empty subfolders. /L makes this a preview; it does not copy the files. Quotes keep a path together if it contains spaces. Source is always the first path and destination the second (Microsoft, 2025).

Expected result: the preview lists the three files and their folders. Destination has not been populated. Even if the preview summary says “Copied,” these are planned actions because /L was used.

Stop and check: if either displayed path is wrong, or the preview shows an access or path error, fix that before continuing. Do not reverse the paths to see whether that works.

Student checkpoint: point to the source and destination in the output. Explain why this preview is not proof of a successful copy.

4 Walk Make a logged copy

The helper checks the generated source against its baseline, rejects links, and prepares Destination and Logs. It retains the original source. The script stops if the source inventory or hashes have changed.

Run the copy script against the practice folder:

$copy = & '.\Student\Copy-RobocopyLab.ps1' -LabPath $lab

The script copies Source to Destination, leaves the source in place, and prints the log path and exit code. Each run gets a new log name, an exit-code record, and a .run.json record of times, paths, options, and tool versions. It stops with an error if Robocopy reports a failure. The quick reference explains the options. PowerShell 7 native-error handling is scoped inside the helper so Robocopy success code 1 is interpreted correctly (Microsoft, 2026a).

Expected first run: three files copied, zero failed files, and normally exit code 1. Destination should now contain the same three files and EmptyFolder.

5 Walk Read the log before claiming success

Open the log at the path printed by the script. Look at the summary near the end, especially the Files row. Record the actual copied, skipped, failed, mismatch, and extra counts.

Result	What it tells you
Copied	Robocopy transferred the selected file. Content verification still follows.
Skipped	Robocopy did not copy it on this run, often because its selection rules considered it unchanged. This is not a hash check.
FAILED	An item could not be processed successfully. Stop and investigate.
Extras or Mismatch	The trees differ in a way that needs an explanation. Do not ignore the difference.

Repeat the same copy

$repeat = & '.\Student\Copy-RobocopyLab.ps1' -LabPath $lab

Expected repeat: zero files copied, three skipped, zero failed, and normally exit code 0. Keep both logs. This shows why zero copied can be a reasonable result after an unchanged repeat.

Exit-code rule: 8 or greater means failure. Codes 0–7 still need interpretation: 0 means no copy was needed, 1 means files were copied, and 2–7 indicate extra or mismatched items, possibly together with copied files. The script flags those for review. A low exit code is not proof of content equality (Microsoft, 2025).

Student checkpoint: explain the difference between a skipped file and a failed file, using your two logs.

6 Run Verify both copies without changing them

The comparison reads both trees, hashes each ordinary file with SHA-256, and pairs files by relative path. It also compares the current source with the pre-copy baseline. It does not copy, change, move, delete, or write report files. Read operations can still affect a live system; this is not write protection or a snapshot.

Retrieve the original baseline receipt from your instructor. Paste only its 64-character SHA-256 when prompted. Do not generate a replacement receipt now.

$receipt = Read-Host 'Paste instructor-held baseline SHA256'
$result = $null
$result = & '.\Student\Compare-RobocopyTrees.ps1' `
  -Source $src -Destination $dst `
  -BaselinePath $baseline -BaselineReceipt $receipt

Screen label	Meaning
Green MATCH	Same relative path, byte length, and SHA-256 on both sides.
Red MISSING FROM DESTINATION	A source file has no destination counterpart.
Yellow EXTRA IN DESTINATION	A destination file has no source counterpart.
Red HASH MISMATCH	Both files exist, but their content hashes differ.
Red BASELINE CHANGED	The current source differs from the original inventory or hashes.
Red INCOMPLETE	The check could not finish or the receipt failed. No pass.

Labels work without color. A renamed file appears as one missing and one extra. Read errors or links stop the check; the script leaves discrepancies intact. Even when both copies change to match each other, the original baseline can expose the change.

Expected result: three MATCH lines, with:

PASS | Match: 3 | Missing: 0 | Extra: 0 | Different: 0
Source baseline: MATCH

PASS means the files read match each other, the current source matches the baseline, and the baseline digest matches the supplied receipt. It does not authenticate who supplied that receipt. Document its custody. Without a baseline, matching trees show MATCH ONLY; empty trees show NO FILES. Neither is PASS.

Check the empty folder separately: confirm Destination\EmptyFolder exists and is empty. This script checks files, not the directory inventory. Hash equality supports the content comparison; ACLs, timestamps, alternate streams, origin, and acquisition completeness remain unverified (Guttman et al., 2022, pp. 7, 11; Microsoft, n.d.).

Stop on a discrepancy: preserve the results and notify the instructor. A mismatch is a finding to investigate, not automatic proof of tampering. Do not rerun the copy to hide the difference (Guttman et al., 2022, p. 7).

6 continued Save and protect your verification

Inspect the full values in memory. Screenshots are useful illustrations, but the saved values allow someone else to review the actual result.

$result.Rows | Format-List RelativePath, Status, `
  SourceSHA256, DestinationSHA256
$record = & '.\Student\Save-LabVerification.ps1' `
  -Result $result -LabPath $lab

The saving helper creates a new Records\verification folder outside both copies. It saves full results as JSON and CSV, the comparison script, and snapshots of the lab logs and kit scripts. It hashes these saved files into record-manifest.json and prints that manifest's SHA-256. An INCOMPLETE comparison has no completed result to save: keep the error text and notes instead.

Protect the second receipt: give the printed record-manifest SHA-256, lab ID, and UTC time to the instructor. Retain the receipt location or reference in your worksheet. A sidecar checksum in the same editable folder is not tamper-proof. Our separate instructor receipt implements NIST's principle of protecting hashes beyond the evidence handler's control (Guttman et al., 2022, pp. 7, 11).

Preserve more than a checksum

Record the original source, who supplied it, how it was created or transferred, and who handled each copy (Guttman et al., 2022, p. 7).
Keep a protected acquired master; examine a verified working copy. In this lab, both folders remain writable simulations. The repeat-copy exercise belongs only in this synthetic lab.
Use approved storage with individual accounts, access controls, and access logs. Preserve a backup at a separate location and recheck after transfer. Two folders on one disk are not a resilient backup (Guttman et al., 2022, pp. 7–9).
Retain the native data and the software needed to read it. Follow applicable retention and release rules; do not invent a universal retention period (Guttman et al., 2022, pp. 9–10).

Record what actually happened

Complete the supplied worksheet as you work. Identify authority and scope, paths and evidence IDs, operator, tool versions, UTC start/end times, clock source or uncertainty, errors, and deviations. Record each custody transfer with sender, recipient, time, purpose, location, and integrity receipt. These worksheet fields are our teaching implementation, not a NIST-prescribed form.

Do not backdate notes or erase a mistake. Add a dated correction that preserves the earlier entry. A script's recorded account and clock are context, not proof of the operator's identity or a trusted timestamp. Instructor custody and review are human steps the scripts cannot perform.

Student evidence and knowledge checks

Hand in a small evidence packet

Completed Student_Worksheet.md, including both instructor-held receipt references and your contemporaneous notes.
The lab folder with Source, Destination, Logs, and Records; submit through the approved classroom channel and retain it until released.
The supplied script kit and saved verification folder, including record-manifest.json. Screenshots may illustrate the result but do not replace these records.
Confirmation that Destination\EmptyFolder exists and is empty, plus explanations for every warning, omission, or failed step.

The instructor checks the manifest against the separately held receipt and rehashes each listed record. A valid manifest protects the recorded packet relative to that receipt; it does not retroactively establish the truth of an unobserved collection.

Write a bounded finding

Use measured results to complete this example. Do not claim facts your records cannot support.

“Between [UTC start] and [UTC end], I compared [count] source and [count] destination files. [count] matched by relative path, byte length, and SHA-256; [count] were missing, [count] extra, and [count] different. The current source [matched/differed from] the pre-copy baseline, whose digest [matched/did not match] receipt [reference]. Copy logs recorded [count] failed files. EmptyFolder [result]. This check did not establish source authenticity, metadata equality, or acquisition completeness. Exceptions: [details].”

Defend your process using your records

What were you authorized to copy, from where, and why this method?
Show the baseline receipt. Who held it, and could you alter it?
Show the exact command, versions, logs, and full hashes supporting your finding. Why does a skipped file still need hashing?
What could change without this test detecting it? Explain the scope of a file-stream check and the absence of a snapshot.
Who handled or accessed the material? Explain every discrepancy and custody gap without claiming certainty the records do not support.

Instructor extension

After saving the clean result, use a separate synthetic pair with one changed file, one source-only file, and one destination-only file. Predict the labels, then run only the comparison. For a further exercise, change both copies identically and compare them with the original baseline and receipt. Explain why two matching copies alone are insufficient (Guttman et al., 2022, p. 11).

No PASS label guarantees admissibility. This exercise supports a traceable explanation of the work performed; real cases require the governing procedures, authority, qualified review, and applicable evidentiary rules.

Quick reference Read when needed

These details explain the canned copy script. You do not need to retype its implementation to complete the lab.

Command or option	Meaning
New-Item -ItemType Directory	Creates a folder. -Path supplies its location.
-Force	Allows an existing folder to be used; does not erase it or bypass permissions.
robocopy source destination	Reads the first folder and writes to the second. Quotes keep paths with spaces together.
/E	Includes subfolders, including empty ones.
/Z	Uses restartable transfer mode.
/R:2 /W:2	Retries failed copies twice, waiting two seconds between retries.
/XJ	Excludes junction points. Their target content may be omitted in a real collection. The lab has no links.
/COPY:DAT	Requests file data, attributes, and timestamps; does not request ACLs, ownership, or auditing.
/DCOPY:DAT	Also requests directory timestamps; the default directory setting is /DCOPY:DA.
/TEE /LOG:path	Shows status and writes a log. /LOG overwrites an existing log of the same name, so the script uses a unique name.
/L	Lists planned work without copying. Used only in the preview.

Three rules for preserving the copies

Copy is not mirror. The source remains, but destination files selected for copying can be overwritten. Destination-only files remain. The copy script is intended only for its generated disposable lab.

Avoid deletion options. /MIR and /PURGE can delete destination extras. /MOVE and /MOV remove source material after copying. None is used here (Microsoft, 2025).

Record omissions. File-level copying is not imaging. Copy flags request metadata; this lab's hash comparison does not verify that metadata. Exclusions, inaccessible files, and unsupported features must be recorded in a real workflow.

Two common problems

ERROR 3 opening the log: check whether the log's parent folder exists and the drive is available in this PowerShell session. Create the parent before starting Robocopy. -Force cannot make an unavailable drive accessible.

Path too long: a long full path and a single overlong filename or folder name are different problems. Robocopy may handle a tree that another tool cannot; the hashing tool must also be able to read it. Do not use /256 as a fix: it disables Robocopy's long-path support. Do not rename original evidence simply to force a copy (Microsoft, 2024, 2025).

References

Guttman, B., White, D. R., & Walraven, T. (2022). Digital evidence preservation: Considerations for evidence handlers (NIST Interagency Report 8387). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8387

Microsoft. (n.d.). Get-FileHash. Microsoft Learn. Retrieved September 19, 2026, from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.6

Microsoft. (2024, July 16). Maximum path length limitation. Microsoft Learn. https://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation

Microsoft. (2025, March 17). Robocopy. Microsoft Learn. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy

Microsoft. (2026a, June 29). about_Preference_Variables. Microsoft Learn. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_preference_variables?view=powershell-7.6

Microsoft. (2026b, August 13). PowerShell support lifecycle. Microsoft Learn. https://learn.microsoft.com/en-us/powershell/scripting/install/powershell-support-lifecycle?view=powershell-7.6

How this guide uses the sources

APA 7 author-date citations identify the source of a claim. NIST page numbers refer to printed report pages, not PDF viewer positions. Guttman et al. is used from the first in-text citation because the report has three authors. The reference entry names all three authors.

NISTIR 8387 is the preservation authority for the review. Microsoft documents command behavior and PowerShell support. The scripts, worksheet, baseline receipt, and crawl–walk–run sequence are our classroom implementation. NIST does not prescribe or certify them.

The instructor package contains NIST_8387_Validation.md with a section-by-section crosswalk, remaining operational limits, and review criteria. This draft remains separate from released book material. Sources checked September 19, 2026.

Student kit

Download the student scripts, worksheet and guide.

The companion retains its own source edition and documented test scope. Author approval does not replace a classroom run.

1. Container workflow · 2. Linux validation · 3. Windows validation · 4. Create and verify your container

Companion lab

SL-02 — Windows Robocopy transfer and verification: tasks, evidence submission and completion criteria.