Get the evidence
Download the image below. The archive is only 51 KB but expands to a 48 MB ext4 image (mostly empty space, so it compresses hard). Verify its SHA-256 before you start, and only ever work on a copy inside an isolated VM.
synapse-lab-01.raw · SHA-256 : 8f1f0c94d35c70a7d0cad5087fcd353d062ed7078c6d4f2099fde41df90e2461
The scenario
On 18 June 2026, an internal alert flagged that a confidential report codenamed ORION may have left the company. A workstation was seized and imaged on the spot. The employee is believed to have assembled an archive, connected a USB device, then tried to cover their tracks by deleting files and clearing their shell history.
You receive a single artefact: a raw disk image. Everything you assert has to come from it, and you have to be equally rigorous about what it cannot prove.
Your mission: establish a defensible chronology, recover the deleted documents, and explain what the artefacts do, and do not, demonstrate.
Set up a clean analysis workstation
Forensics starts before the first command. Never open the original in write mode, and log every action so your work is reproducible by someone else. Use a disposable VM, Ubuntu or a forensic distribution, with no network access.
sudo apt update
sudo apt install sleuthkit foremost libimage-exiftool-perl
mkdir -p ~/synapse-lab/{evidence,work,output}
unzip synapse-lab-01.zip -d ~/synapse-lab/evidence
chmod 444 ~/synapse-lab/evidence/synapse-lab-01.raw # read-only: protect the original
cd ~/synapse-lab/work
Evidence rule: record the source, the time of reception, the initial hash, every action you take, and the final hash. If a hash changes, your evidence is compromised.
Work the image, step by step
The Sleuth Kit gives you everything you need on a raw image: identify the filesystem, inventory live and deleted entries, build a timeline, then pull files back out by inode.
Preserve
Hash the image before you do anything else. This value anchors your chain of custody.
sha256sum synapse-lab-01.raw
Identify
Confirm what you are looking at, and read the volume label and superblock metadata.
file synapse-lab-01.raw fsstat synapse-lab-01.raw | less
Inventory
List every entry, then list again including deleted ones. The deleted inodes are where this case lives.
fls -r -p synapse-lab-01.raw fls -r -d -p synapse-lab-01.raw
Build the timeline
Turn the filesystem timestamps into a chronological CSV. mactime normalises the MAC times into one sortable view.
fls -r -m / synapse-lab-01.raw > bodyfile.txt mactime -b bodyfile.txt -z Europe/Brussels -d > timeline.csv
Focus the window
Filter the timeline to the day of the incident and the keywords that matter.
grep '2026-06-18' timeline.csv grep -Ei 'orion|transfer|zip|history' timeline.csv
Recover by metadata
When the inode still points at the data, icat pulls the exact original file back with its context intact. Replace INODE with the value from step 3.
icat synapse-lab-01.raw INODE > recovered-orion.pdf file recovered-orion.pdf sha256sum recovered-orion.pdf
Carve for what metadata lost
For entries whose metadata is gone, carve by file signature straight from the raw blocks.
foremost -i synapse-lab-01.raw -o carving-output
find carving-output -type f -exec file {} \;Correlate and conclude
Cross-check recovered files, shell history and timestamps. tsk_recover bulk-extracts the allocated files so you can grep across everything at once.
mkdir extraction tsk_recover synapse-lab-01.raw extraction grep -REin 'ORION|TRANSFER|history -c' extraction/ carving-output/
Metadata recovery vs carving
fls + icat
Uses the filesystem entry. When the inode is intact it can preserve the original name, the inode number and the surrounding context, so the recovered file is trustworthy.
foremost (carving)
Scans raw blocks for known file signatures. It recovers content even without a filesystem entry, but the original name and path are usually lost, and fragmented files can come back incomplete.
A fragmented file can be recovered incomplete. And a found signature does not prove the file was opened, written to the USB device, or exfiltrated. State the limit, do not assume it away.
Your deliverable
- What is the SHA-256 of the image?
- Which filesystem and which volume label do you identify?
- Which files were deleted, and what are their inodes?
- At what time was the USB device connected?
- At what time was the archive created?
- Which confidential document can you recover, and by which method?
- What difference do you observe between icat recovery and carving?
- Write a short conclusion that clearly separates facts from hypotheses.
Guided answer key
Show the answer elements
- ext4 volume, label
SYNAPSE_LAB. - Main activity window: 18 June 2026, roughly 09:03 to 09:25 CEST.
- USB
TRANSFERmounted: 09:06:41 to 09:24:55. orion-export.zipcreated at 09:11:08.- The ORION PDF report and the ZIP archive were deleted.
history -clogged at 09:20:02 (an attempt to clear the trail).
Cautious conclusion: the evidence supports the hypothesis of a copy being staged, but does not on its own prove that the archive was written to the USB device or transmitted outside the company.
A reproducible report
However you tool the case, the write-up follows the same six beats. Keep facts and interpretation in separate sections.
1. Mandate
Question asked and scope.
2. Integrity
Source, custody and hashes.
3. Method
Tools, versions and commands.
4. Findings
Timeline and recovered evidence.
5. Limits
Gaps, ambiguities, what is missing.
6. Conclusion
Facts, then hypotheses, kept apart.
Going further
This lab mirrors the first hours of a real internal investigation: preserve, timeline, recover, and stay disciplined about the gap between what an artefact shows and what it proves. Two files can look identical yet tell different stories depending on where they came from, a live inode or a carved fragment.
To dig deeper:
- The Sleuth Kit & Autopsy, the open-source toolkit behind fls, icat, mactime and tsk_recover.
- foremost, signature-based file carving for images and unallocated space.
- SANS DFIR posters, Windows and Linux forensic timelines and artefact cheat sheets.
- ext4 on-disk layout, how inodes, extents and journaling actually store your evidence.
Entirely fictional environment, for educational use only. Work in an isolated VM.
A Belgium-based provider of cybersecurity solutions, and the team behind SynapseRM / TPRM.