Home labs & practical projects

Preserve a small digital evidence set

A project to do with your own tools, with guidance on what to create and capture.

Local lab Suggested time: 90–120 minutesYour own authorised environment

What you could create

A fictional investigation receives a removable-media image and needs a reliable record of handling before analysis begins.

Example evidence format

Project evidence map (example)

Chain-of-custody and integrity recordScope and inputs

Forensic examination noteDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Chain-of-custody and integrity record	Show the inputs, scope and decisions behind this record. Original and working-copy hashes are recorded and explained.
Forensic examination note	Include the evidence supporting your conclusion. The report separates recovery of an artefact from conclusions about its author.

What you'll need

Local lab

Create a small test disk image containing harmless documents or use a lawful teaching image. Prepare an evidence identifier and custody form.

Project record

Keep the working files for chain-of-custody and integrity record and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.

Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.

Suggested milestones

1
Plan and investigate
Record acquisition context, hashes and storage location.
2
Develop your approach
Create a working copy and document every handling step.
3
Verify and explain
Recover a selected test artefact and describe the limits of the method.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Chain-of-custody and integrity record
Show the inputs, scope and decisions behind this record. Original and working-copy hashes are recorded and explained.
2
Forensic examination note
Include the evidence supporting your conclusion. The report separates recovery of an artefact from conclusions about its author.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your chain-of-custody and integrity record needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Create a small test disk image containing harmless documents or use a lawful teaching image. Prepare an evidence identifier and custody form.

What a good result looks like

Original and working-copy hashes are recorded and explained.
The report separates recovery of an artefact from conclusions about its author.

Finish the project

Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.