CyberPatriot Training Hub
Forensics
Learn how to answer forensic questions from evidence rather than guesses. Build skill with files, metadata, hashes, logs, users, processes, services, persistence, network activity, browser artifacts, and timeline reconstruction.
This pathway is designed for defensive CyberPatriot practice in fictional or authorized environments. It teaches how to find, preserve, correlate, and explain evidence without live-round answers.
Pathway Snapshot
Main question
What does the evidence actually support?
Identify the exact question, find the most relevant evidence, preserve context, corroborate where possible, and state only the conclusion the artifacts justify.
Safety boundary
Inspect, do not execute
Unknown files, attachments, scripts, macros, and binaries should not be executed simply to investigate them. Focus on safe evidence review.
Forensics workflow
Question to evidence to answer
Read the question exactly
Identify whether the prompt asks for a user, file, time, process, service, address, event, action, or sequence.
Choose the evidence source
Decide which artifact is most likely to answer the question instead of searching the whole system randomly.
Collect context
Record timestamps, paths, users, IDs, hashes, neighboring events, and fields that give the artifact meaning.
Corroborate
Use another source where possible so one misleading timestamp, filename, or log entry does not become the whole conclusion.
Answer only what is supported
Separate direct observation from inference and avoid adding certainty the evidence does not justify.
Evidence zones
Know where different answers are likely to live
Files & Metadata
Paths, names, extensions, size, ownership, permissions, timestamps, hashes, archives, hidden items.
Logs & Events
Authentication, services, system events, application logs, administrative changes, errors, warnings.
Accounts & Privilege
Users, groups, login history, failed logins, privilege changes, administrative actions.
Processes & Persistence
Running processes, services, startup items, scheduled tasks, cron jobs, configuration references.
Network Evidence
Listeners, local and remote addresses, ports, connection state, process ownership, DNS references.
User Activity Artifacts
Browser history, downloads, documents, email metadata, recent files, application traces.
Reasoning principles
Avoid conclusions the evidence cannot support
Artifact does not equal intent
A browser entry, file, process, or account can show that something existed or occurred without proving why a person did it.
Timestamps need context
Creation, modification, access, event, and log timestamps can represent different actions and may use different time zones.
Names can mislead
A filename or process name is only one clue. Path, hash, parent process, owner, and surrounding evidence matter too.
Preserve before changing
Service restarts, file deletion, account changes, and log clearing can destroy evidence needed to answer later questions.
Correlate independent sources
Stronger conclusions usually come from multiple artifacts that agree on user, time, host, path, or action.
Keep answers scoped
Forensic questions often ask for one exact fact. Give the fact and supporting evidence rather than a broad unsupported story.
Lesson pathway
Eighteen lessons from evidence basics to case reconstruction
Forensics Competition Workflow
Focus
Turn a forensic prompt into a focused evidence search and answer only from verifiable artifacts.
Defensive lab
Work through a fictional question-to-evidence exercise.
Evidence Preservation & Documentation
Focus
Preserve context, record observations, separate facts from interpretation, and avoid destroying evidence.
Defensive lab
Create a simple evidence worksheet for a fictional workstation.
Hashing & File Integrity
Focus
Use cryptographic hashes to compare files, verify integrity, and document exact file identity.
Defensive lab
Hash a fictional file set and compare matching and changed artifacts.
File Systems & Important Paths
Focus
Understand common Windows and Linux evidence locations, profiles, logs, temporary data, startup locations, and application storage.
Defensive lab
Map likely evidence locations in fictional Windows and Linux systems.
File Metadata & Timestamps
Focus
Interpret filename, size, ownership, permissions, extension, and timestamps without treating metadata as unquestionable proof.
Defensive lab
Compare fictional file metadata and identify facts that need corroboration.
Log Analysis Fundamentals
Focus
Read logs as event records, filter noise, identify useful fields, and connect timestamps, users, hosts, and actions.
Defensive lab
Extract a short relevant sequence from a fictional mixed log set.
Windows Event Logs
Focus
Navigate common Windows event channels and correlate authentication, service, and system evidence.
Defensive lab
Review a fictional Windows event timeline.
Linux Logs & Journal
Focus
Review Linux authentication, service, system, and administrative evidence using common logs and journal-style records.
Defensive lab
Build a timeline from fictional Linux logs.
User Accounts & Authentication Evidence
Focus
Review users, groups, logins, failed authentication, privilege use, and account changes without assuming unusual means malicious.
Defensive lab
Compare expected and observed account activity.
Processes, Services & Startup Evidence
Focus
Use process, service, startup, and configuration evidence to understand what was running and what may start automatically.
Defensive lab
Classify a fictional process and service inventory.
Scheduled Tasks, Cron & Persistence Clues
Focus
Review scheduled execution and startup persistence locations while preserving required automation.
Defensive lab
Investigate a fictional scheduled-task and cron evidence set.
Network Connections & Listening Services
Focus
Interpret local and remote addresses, ports, listeners, active connections, and process ownership in context.
Defensive lab
Correlate fictional connection records with processes and required services.
Browser & Download Artifacts
Focus
Reason about browser history, downloads, filenames, and timestamps without overclaiming user intent.
Defensive lab
Answer questions from a fictional browser and download history dataset.
Email, Documents & Suspicious File Triage
Focus
Inspect sender, recipient, subject, attachment, filename, extension, metadata, and hashes while keeping analysis non-executing.
Defensive lab
Triage a fictional email and document evidence package.
Archives, Hidden Files & Alternate Storage Awareness
Focus
Recognize compressed archives, hidden items, unusual extensions, and alternate storage locations without treating concealment alone as proof.
Defensive lab
Inventory a fictional directory with visible, hidden, and archived evidence.
Timeline Reconstruction & Correlation
Focus
Combine files, logs, authentication, processes, services, network, and browser evidence into a defensible sequence.
Defensive lab
Construct a fictional cross-source timeline.
Forensics Practice Case
Focus
Apply the full workflow to a fictional multi-source case without being told which artifact contains the answer.
Defensive lab
Complete a competition-style case using multiple evidence sources.
Forensics Final Review Checklist
Focus
Review the highest-value evidence sources, reasoning mistakes, documentation habits, and final verification steps.
Defensive lab
Run a timed fictional final review and produce an evidence-backed answer sheet.
Fictional evidence preview
One artifact rarely tells the whole story
A training workstation contains an unexpected archive in a user's Downloads folder. A browser record, file metadata, hash, authentication events, process evidence, and connection records each contribute a different part of the answer.
Pathway outcome
What you should be able to do
Choose the right evidence source for a specific forensic question.
Read Windows and Linux logs without treating every event as important.
Use metadata and hashes carefully.
Correlate users, files, processes, services, network activity, and browser artifacts.
Recognize persistence clues without deleting evidence too early.
Build a defensible timeline from multiple sources.
Write concise evidence-backed competition answers.
Recognize when evidence is insufficient and more corroboration is needed.
Safe evidence handling
Preserve what you may need later
Use only CyberPatriot images, fictional evidence, lab systems, or other environments you are authorized to inspect.
Do not execute unknown attachments, scripts, macros, binaries, or archived content merely to investigate them.
Preserve logs and artifacts before changing services, accounts, scheduled tasks, or startup entries.
Do not publish real credentials, private user data, API keys, secrets, or complete sensitive configurations.
A forensic answer should be based on the provided evidence, not assumptions about a real person's motive or identity.
Start here
Begin with the Forensics Competition Workflow
Lesson 01 will teach how to turn a forensic prompt into a focused evidence search without jumping directly into every file, log, and configuration on the system.
Start Lesson 01 →