Forensics · Lesson 18
Forensics Final Review Checklist
Review the complete CyberPatriot forensics workflow, the most useful Windows and Linux commands, the strongest evidence sources, preservation rules, reasoning traps, and final-answer discipline.
Use this page as your final pre-competition reference: question, evidence, corroboration, preservation, remediation, documentation, and concise conclusion.
Final Review Snapshot
Learning objectives
Finish the forensics track with a complete competition checklist
Review the complete CyberPatriot forensics workflow from question to evidence-backed conclusion.
Use a repeatable checklist for Windows and Linux evidence collection without destroying useful state.
Match common forensic questions to the strongest evidence sources.
Preserve timestamps, hashes, account context, process relationships, service state, scheduler configuration, and network evidence before remediation.
Recognize common overclaims, weak assumptions, and evidence gaps before submitting an answer.
Finish competition forensics work with concise documentation that another teammate can verify.
Final principles
The habits that protect both evidence and your score
Read the question exactly
Identify what must be proved, which system is in scope, and whether the question asks for a user, file, time, process, service, connection, or sequence.
Choose the evidence source before searching
Authentication questions belong in account and log evidence. Execution questions require process evidence. File identity questions require hashes.
Preserve before changing
Record the state that could disappear if you stop a service, kill a process, disable an account, delete a task, move a file, or change a firewall rule.
Corroborate important claims
Use independent sources when possible. One artifact can be incomplete or misleading.
Separate fact from inference
Write what the artifact directly proves first, then clearly label broader conclusions.
Stop where the evidence stops
Do not invent intent, identity, or causation when the evidence only shows sequence or association.
Competition workflow
From question to defensible answer
Read the prompt
Underline the exact entity, time, action, or relationship the question asks you to identify.
Select the strongest source
Choose the log, file, account database, process state, scheduler record, network state, or browser artifact most likely to answer it.
Collect the minimum useful context
Record time, source, identifier, path, account, PID, hash, event ID, or other fields needed to verify the observation.
Corroborate
Use a second independent artifact when the conclusion matters or one source leaves ambiguity.
Classify confidence
Decide whether the conclusion is directly observed, strongly correlated, weakly inferred, or unsupported.
Preserve before remediation
Document the original state before changing accounts, tasks, services, files, firewall rules, or other evidence-producing configuration.
Answer concisely
Give the direct answer, cite the supporting evidence in your notes, and state any important limitation.
Question-to-evidence map
Start with the source most likely to answer the question
Does an account exist?
Strongest source
Local account database / getent / Get-LocalUser
Supporting
Profile/home directory, account logs
Is the account privileged?
Strongest source
Local group membership, UID/GID, sudo/admin group evidence
Supporting
Security events and policy context
Did the account authenticate?
Strongest source
Windows Security log, auth.log, journal, SSH/PAM records
Supporting
Session records, last/who/w
Was a file downloaded?
Strongest source
Browser download record plus matching local file
Supporting
Filesystem metadata and hash
Was a file executed?
Strongest source
Process creation evidence or command line
Supporting
Task/service logs, application records
Is this the same file?
Strongest source
SHA-256 comparison
Supporting
Size, path, timestamps
Why did a process start?
Strongest source
Parent process, service, task, cron, timer, or startup source
Supporting
Logs and process start time
What is listening?
Strongest source
Socket state with owning PID
Supporting
Process path, service configuration, firewall state
What caused recurring execution?
Strongest source
Scheduled task, cron, or timer plus execution history
Supporting
Process and log correlation
How did events unfold?
Strongest source
Normalized multi-source timeline
Supporting
Authentication, browser, file, process, service, network evidence
Windows quick reference
High-value read-only checks
Accounts
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember -Group "Administrators"
whoami
whoami /groups
Logs
Get-WinEvent -LogName Security -MaxEvents 50
Get-WinEvent -LogName System -MaxEvents 50
Get-WinEvent -LogName Application -MaxEvents 50
Processes
Get-Process
Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Services
Get-Service
Get-CimInstance Win32_Service | Select-Object Name,State,StartMode,StartName,PathName
Scheduled Tasks
Get-ScheduledTask
Get-ScheduledTaskInfo -TaskName "ExampleTask"
Network
Get-NetTCPConnection
Get-NetTCPConnection -State Listen
netstat -ano
Files
Get-Item "C:\Path\To\File" | Format-List *
Get-FileHash "C:\Path\To\File" -Algorithm SHA256
Get-Acl "C:\Path\To\File"
Firewall
Get-NetFirewallProfile
Get-NetFirewallRule -Enabled True
Linux quick reference
High-value read-only checks
Accounts
getent passwd
getent group sudo
id trainee
groups trainee
Sessions
who
w
last -F
lastlog
Logs
journalctl -n 50
journalctl -b
grep -i "sudo|sshd|cron" /var/log/auth.log
Processes
ps aux
ps -eo pid,ppid,user,lstart,cmd
pstree -ap
Services
systemctl --type=service --state=running
systemctl status ssh
systemctl cat ssh
Scheduling
crontab -l
sudo cat /etc/crontab
systemctl list-timers --all
Network
sudo ss -lntup
sudo ss -ntup
Files
stat /path/to/file
file /path/to/file
sha256sum /path/to/file
Windows event IDs
Useful Security and System event awareness
Check logon type and account context.
Failure alone does not prove attack.
Interpret with process/session context.
Privilege presence is not proof of misuse.
Does not by itself identify who physically created it.
Correlate with surrounding account-management activity.
Could be normal administration or team action.
Historical logs may remain after deletion.
Group membership provides capability, not proof of action.
Document whether this was original activity or remediation.
Correlate with binary path, package/software context, and scenario requirements.
State change alone does not explain why it occurred.
Windows logon types
Authentication context changes the meaning of Event 4624
Interactive
Network
Batch
Service
Unlock
RemoteInteractive / RDP
CachedInteractive
Preserve before action
Record the state that remediation could erase
Account
Username, SID/UID, enabled state, group membership, home/profile path, shell, last-login context, related auth events.
Process
PID, name, executable path, command line, parent PID, user, start time, hash, network state.
Service
Name, state, start mode, run-as account, executable path/ExecStart, logs, dependencies, related process.
Scheduled item
Name, trigger, action, arguments, run-as account, enabled state, history, linked file.
File
Full path, size, owner, permissions, timestamps, actual type, SHA-256, source context.
Network connection
Protocol, local/remote addresses and ports, state, PID, process, service, user, timestamp.
Browser download
Browser profile, source URL, filename, destination, time, size, local hash, later process evidence.
Archive
Archive path, hash, timestamps, internal paths/times, extracted paths/hashes, extraction evidence.
Reasoning traps
Replace weak claims with evidence-safe language
Weak claim
Account exists, so it was used.
Better
The account exists. Separate authentication or session evidence is required to prove use.
Weak claim
User is an administrator, so they performed the change.
Better
The user has administrative capability. Action attribution requires process or log evidence.
Weak claim
The file was downloaded, so it was executed.
Better
The browser recorded a download. Execution requires process or application evidence.
Weak claim
The port is 443, so the traffic is safe.
Better
The connection uses remote port 443. Port number alone does not establish destination trust.
Weak claim
The service runs as SYSTEM, so it is malicious.
Better
The service runs with high privilege. Legitimacy depends on path, source, purpose, and scenario.
Weak claim
The file is hidden, so it is suspicious.
Better
The file is hidden. Visibility state alone is not evidence of malicious intent.
Weak claim
Defender found nothing, so the file is clean.
Better
No detection was recorded by that scan. This is not proof of safety.
Weak claim
The first event caused the second event.
Better
The events occurred in sequence. Causation requires a supported connection between them.
Timeline checklist
Before trusting event order
Preserve the original timestamp exactly as shown.
Record timezone or offset.
Label timestamp type.
Identify source host/application.
Normalize copies of timestamps only for comparison.
Account for archive/copy behavior.
Check for clock drift or VM snapshot effects.
Separate direct observation from inferred sequence.
Corroborate major links with another source.
Record team remediation actions separately.
State confidence and unresolved gaps.
Browser checklist
Before concluding what happened after a download
Browser/profile identified
Visited URL recorded
Download source recorded
Destination path recorded
Download time recorded
Local file located
File size checked
Actual type checked
SHA-256 recorded
Later open/execute evidence checked
Session context checked
File triage
Suspicious file checklist
Do not execute unknown files
Record original path
Record filename and extension
Verify actual file type
Record size
Record owner/permissions
Record timestamps
Calculate SHA-256
Check source context
Check process/application use
Preserve archive/container first
Avoid enabling macros or active content
Scheduling
Task / cron / timer checklist
Name / path
Trigger
Action
Arguments
Working directory
Run-as account
Enabled state
Last/next run
Execution history
Linked script/executable
File hash
Related process evidence
Network
Connection / listener checklist
Protocol
Local address
Local port
Remote address
Remote port
Connection state
Owning PID
Process name
Executable path
User/service context
Firewall context
Scenario requirement
Confidence
Label how strongly the evidence supports your conclusion
Direct
The artifact itself records the fact being stated.
Strongly correlated
Multiple independent artifacts support the same link or sequence.
Moderate
The evidence is consistent but one important link remains indirect.
Weak
Only one ambiguous artifact supports the claim.
Unsupported
The available evidence does not justify the claim.
Competition sequence
What to do from the first minute to final submission
Start
Read the question, note exact wording, identify host/account/file/process/time scope.
Collect
Gather the strongest direct evidence with minimal changes to system state.
Correlate
Cross-check with a second source, then map account → file → process → service/task → network as needed.
Preserve
Capture screenshots/notes, hashes, IDs, paths, times, and relevant configuration before remediation.
Remediate
Only make changes that are justified by the scenario and do not break required services.
Document
Record what changed, when, why, and which evidence existed before the change.
Answer
Give the concise result, strongest evidence, confidence, and any important limitation.
Final fictional review
One last evidence chain before competition
trainee-final begins a fictional interactive session.
Browser records download of toolkit.zip.
toolkit.zip appears in Downloads with SHA-256 HASH-FINAL-1.
Archive contains scripts/check.ps1.
check.ps1 appears in AppData and matches the archived script hash.
Task FinalCheck is configured to launch check.ps1 every 20 minutes.
PowerShell starts with check.ps1 in the command line.
Child process connects to fictional 203.0.113.200:443.
Review 01
What proves toolkit.zip was downloaded?
The browser download record plus the matching local archive appearance.
Review 02
What proves check.ps1 came from the archive?
The archive listing, extracted local path, and matching file hash.
Review 03
What proves scheduled persistence?
The FinalCheck task configuration plus the later PowerShell execution.
Review 04
What proves outbound network activity?
The network evidence tied to the child process after check.ps1 execution.
Review 05
What should not be claimed?
Do not claim malicious intent, human attribution, or destination reputation without additional evidence.
Review 06
What should be preserved before disabling the task?
Task configuration, file path/hash, process chain, network evidence, relevant logs, and timestamps.
Final mistakes
The errors most likely to weaken your forensic answer
Changing before documenting
Stopping or deleting the evidence source can erase the strongest proof.
Answering from memory
Use the actual artifact and current system state rather than relying on what a command usually shows.
Using one source for everything
Different questions require different evidence sources.
Confusing capability with action
Privilege, macro capability, or service permission does not prove use.
Ignoring time context
Timezone, timestamp type, and archive behavior can completely change the sequence.
Breaking required services
Always compare a suspicious-looking component with scenario requirements before disabling it.
Treating no detection as safe
Security tools add evidence, not certainty.
Overwriting uncertainty
If a fact cannot be proved, say so.
Final competition checklist
Before submitting any forensic answer
I know exactly what the question asks.
I chose the strongest evidence source.
I recorded original timestamps and timezone context.
I recorded stable identifiers such as SID, UID, PID, event ID, or SHA-256 where useful.
I mapped processes to paths, parents, users, services, tasks, or sockets when relevant.
I distinguished configured state from actual execution.
I distinguished file presence from opening or execution.
I distinguished privilege capability from proof of privileged action.
I preserved evidence before remediation.
I checked scenario requirements before disabling anything.
I recorded my own changes separately.
I corroborated important conclusions.
I labeled inference and uncertainty.
I avoided exposing passwords, hashes from protected credential stores, tokens, or private keys.
I wrote a concise final answer another teammate can verify.
Reflection
Final self-check
Question 1
Which evidence source would you use first for a question about account creation?
Question 2
What is the strongest way to prove two files contain the same content?
Question 3
Why is a scheduled task definition not enough to prove execution?
Question 4
Why must a listening port be mapped to a PID and executable?
Question 5
What evidence would you preserve before disabling a suspicious service?
Question 6
What does a good final forensic answer include besides the conclusion?
Forensics track complete
You now have the complete 18-lesson Forensics pathway. The next step is wiring every lesson's Previous/Next navigation and enabling the Forensics hub only after one full browser sweep.