DFA · Forensics

Digital Forensics Analyst

Intermediate

A competency-based assessment covering digital evidence handling, filesystem analysis, Windows registry artifacts, memory acquisition and reporting. Passing issues the Digital Forensics Analyst credential — a professional certificate, publicly verifiable and mapped to recognised forensic standards.

Flags / tasks 16

Environment Free-text

Access Super VIP

Price TBA

Objectives

Flag every task to complete the lab

16 aims

1 Which command prints an SHA-256 checksum of a file on Linux?

2 Which partition table format is required for booting UEFI systems?

3 Which NTFS system metadata file is the Master File Table?

4 Which Windows registry hive holds per-user configuration and is loaded at logon?

5 Which Wireshark display filter isolates only TCP packets?

6 Which e-mail header field lists every server that relayed a message?

7 What is the term for the unused bytes between the logical end of a file and the end of its last disk cluster?

8 Which Windows registry key records the history of connected USB storage devices?

9 On a master boot record (MBR) disk, what is the maximum number of primary partitions?

10 Which memory forensics tool analyses a RAM dump to enumerate running processes (e.g. via pslist)?

11 Which hashing tool from the mddeep suite builds an integrity manifest of files for imaging?

12 In Google Chrome, browser history is stored in an SQLite database file with which name?

13 Which Windows file holds committed virtual memory and is a key volatile-data artifact?

14 Which Sleuth Kit tool produces a mactime-format body file from a raw disk image?

15 Hiding a message in the least-significant bits of an image's pixels is a form of what?

16 Which Windows event log records account logon and logoff events?

Learning outcomes

Mapped skills

NIST SP 800-86 (Integrating Forensic Techniques)
NIST SP 800-101 (Mobile Device Forensics)
ACPO Good Practice Guide

Work through the free-text objectives below. Correct answers lock in; keep going until every task is owned. Complete all objectives to earn a unique, publicly verifiable credential (verify link, score snapshot and integrity hash) bound to this Pro Lab.