Home labs & practical projects

Correlate host artefacts into a defensible timeline

A project to do with your own tools, with guidance on what to create and capture.

Local lab Suggested time: 3–4 hoursYour own authorised environment

What you could create

A training workstation image contains conflicting timestamps. An investigator must explain what happened while preserving uncertainty about event ordering.

Example evidence format

Project evidence map (example)

Host timeline with artefact referencesScope and inputs

Methodology and uncertainty statementDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Host timeline with artefact references	Show the inputs, scope and decisions behind this record. The original dataset remains unchanged.
Methodology and uncertainty statement	Include the evidence supporting your conclusion. The report does not treat one artefact as conclusive proof of user intent.

What you'll need

Local lab

Use a lawful educational forensic dataset with documented provenance. Record hashes, timezone assumptions and the tools used for analysis.

Project record

Keep the working files for host timeline with artefact references and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.

Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.

Suggested milestones

1
Plan and investigate
Extract relevant filesystem, execution and user-activity artefacts.
2
Develop your approach
Correlate events while distinguishing timestamp meanings and clock differences.
3
Verify and explain
Write a timeline with confidence levels and alternative explanations.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Host timeline with artefact references
Show the inputs, scope and decisions behind this record. The original dataset remains unchanged.
2
Methodology and uncertainty statement
Include the evidence supporting your conclusion. The report does not treat one artefact as conclusive proof of user intent.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your host timeline with artefact references needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

GIAC official practice tests (2 included with exam)

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Use a lawful educational forensic dataset with documented provenance. Record hashes, timezone assumptions and the tools used for analysis.

What a good result looks like

The original dataset remains unchanged.
The report does not treat one artefact as conclusive proof of user intent.

Finish the project

Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.