SL-01 — Create and verify a forensic artifact container

Supplemental lab · v23 · complements the Progressive Labs without changing their sequence

Procedure

1. Use FG09 C01–C02 to create a new synthetic workspace and record the OS, filesystem, mount policy, clock context and tool versions.

2. Use C03–C05 to record source metadata before hashing, compare the post-read state and define the seven-member scope.

3. Use C06–C08 to create the archive, check its member list and retain the full archive digest independently.

4. Use C09–C10 only with an instructor-provisioned SSH endpoint and verified host key. Record sender/receiver paths, exit status and received hash. If unavailable, mark the transfer untested; do not substitute a local copy as proof.

5. Use C11–C15 to rehearse or complete verified receipt, extract into a new Linux directory and compare content, timestamps, identity, ACLs and xattrs.

6. Use C16 to state exactly what was preserved. Use the Linux then Windows validation pages to explain the observed changes.

Submit

Environment record; source/post-read metadata; archive member list; independent digest receipt; transfer or explicit untested record; extraction hashes; metadata comparisons; bounded conclusion.

For each screenshot, include the command, relevant input, complete result and a step label. Keep raw logs with screenshots. Report errors and untested steps explicitly.

Completion criteria

• Correct input scope and recorded environment.
• Commands follow the companion guide and their exit status is explained.
• Content checks and metadata observations are supported by retained evidence.
• Results distinguish observations from expected examples and untested claims.
• The analyst conclusion does not exceed the evidence.