Build a lab machine

The written labs assume a machine you can break and roll back. This builds one, from a script you can read, on hardware you already own. Free, and nothing here is ours except the script.

why a script and not a download

A prepared disk image is several gigabytes, goes stale the week it is built, and asks you to boot a disk assembled by somebody you have never met. This is eleven kilobytes, installs current packages from Ubuntu’s own repositories, and you can read the whole thing first.

Please do read it. An audience that spends its working life telling people not to run untrusted scripts should not make an exception for a security website, this one included.

1. the virtual machine

Any hypervisor. VirtualBox is free on Windows and Linux, UTM is free on Apple Silicon, and VMware Workstation Player is free for personal use. Install Ubuntu 24.04 LTS or Debian 12.

4 GB RAM minimum, 8 GB if you intend to open memory images.
60 GB disk, dynamically allocated. Evidence gets large.
Networking off once you are done installing. A lab machine with evidence on it does not need the internet, and an analysis VM that can reach your own network is a bad habit to form early.

2. read the script, then run it

download and read

curl -fsSLO https://securityartifacts.com/lab/provision.sh

# check it is the file this page describes
sha256sum provision.sh
# expected: 1eda228bbf55979864529a20759d45ba018c1461763b03e0c319cf5ca0307074

# read it. it is 200 lines.
less provision.sh

# then, on a VM you have snapshotted:
bash provision.sh

That checksum is computed from the file this page links to, at the moment the page renders, so the two cannot drift apart. If what you download does not match it, do not run it.

3. what it installs

for	tools
Disk and filesystem	sleuthkit, libewf, afflib, testdisk, xmount, libguestfs
Malware triage	yara, clamav, binwalk, foremost, ssdeep
Network	tshark, tcpdump, ngrep, zeek where available
Registry and databases	regipy, libesedb, sqlite3
General	python3, pandas, ripgrep, jq, hexedit, build-essential

Python tooling goes in a virtual environment at ~/.dfir rather than into the system Python, so apt and pip cannot fight over the same packages. It also creates ~/lab/evidence, ~/lab/output and ~/lab/tools.

4. snapshot it

Before any evidence touches it. Every written lab assumes you can roll back to a clean machine, and half of learning this work is learning to keep the original untouched and work on a copy.

no machine to spare?

The lab console runs in your browser with nothing installed at all, on a work laptop with no admin rights or on a phone. It is a different exercise rather than a lesser one: the console is about reasoning over parsed evidence, and this machine is about producing it.