Skip to content
Skip to main content

Practical activities

Sometimes it helps to use the system and see what happens. At other times, the useful practice is working through material somebody has supplied. Choose the activity that fits what you want to understand.

Technical simulations let you operate screens and controls, then explain the system's response. Guided walkthroughs take you through a mechanism. Investigation exercises give you material to interpret and decisions to make.

New to these? How our simulations work explains what they are, what they give you and how they differ from a full virtual machine.

Ransomware — guided Windows exercises

Follow one incident using a reusable Windows workstation and its linked records. Work in the machine on the left while the Task panel explains the next action on the right.

  1. First foothold — inspect the account, host, network and sign-in event
  2. Follow the file — inspect metadata, calculate SHA-256 and match the source record
  3. Read a process tree — inspect the parent, child and process creation record

These exercises belong to the course Ransomware: The Offender Perspective. You can also use them on their own and reset them at any time.

Technical simulations

Why does the DNS answer change?

Look up five website names and compare their IP addresses. Then change one website’s published address and discover why a computer can briefly keep the old answer.

Telegram Cloud Chat versus Secret Chat

Use a realistic Telegram-style phone and a linked desktop to send a Cloud Chat message, then start a separate Secret Chat. Compare what appears on each client and why that matters when examining devices.

Explore a Linux web server

Use an Ubuntu terminal and file browser to inspect an Nginx server. Jordan’s Windows laptop and Alex’s Galaxy phone can visit the Elm Street Motors demo site and create new access, error and application records. Switch the phone between home Wi-Fi and mobile data, inspect processes and connections, or watch requests arrive with tail -f.

Explore the Linux web server in a new tab →

  • Format: open environment; no guided tasks or answer gates
  • Includes: Linux folders and files, terminal commands, Windows browser and command prompt, and a mobile browser
  • Records: one shared environment connects client actions to the files on the server

Finding IP addresses in a real network

Examine one ordinary home-network computer and its Home Gateway. Compare the local address, gateway, router WAN address and an explicit neighbour-cache observation, then decide what must be established before interpreting an IP address from an online service.

Start Finding IP addresses in a real network →

The Domestic Network

Explore a home router, find useful information and work out what it tells you. The final optional stage lets you practise a specific forwarding change in a browser-local working copy.

  • Structure: nine core stages and one optional configuration stage

Before starting, review what DHCP, router and Wi-Fi records can show about a local device and what to do when you encounter a router or network appliance.

Firewall and Forwarding

Continue in the same Home Gateway after completing The Domestic Network. Predict and apply a bounded forwarding change, compare configuration with activity evidence, and interpret a separately supplied generic firewall-log exhibit.

  • Structure: seven applied stages using the familiar Router/Task workspace
  • Safe working copy: changes stay in this browser and reset to the observed baseline
  • Log fidelity: the downloadable exhibit is explicitly not an export from the simulated gateway

Start with The Domestic Network if you have not yet used the router.

Looking Inside an Email

Open a mailbox, look behind a sender’s display name, compare From and Reply-To, inspect a link destination and view selected message headers.

  • Duration: 20–30 minutes
  • Format: seven guided steps in a single Task panel

The simulation links to deeper lessons about From, Reply-To and Return-Path, examining links and email headers as those concepts appear.

Which MAC Address Belongs to This iPhone?

Inspect iPhone Settings, distinguish its hardware Wi-Fi and Bluetooth addresses, and compare network-specific private Wi-Fi addresses with a router record.

  • Structure: six guided steps in a Phone/Task workspace
  • Current behaviour: uses the current iOS 18-or-later Off, Fixed and Rotating labels supported by the source lesson

Before starting, review how MAC and private Wi-Fi addresses differ. The activity links to the supporting mobile-identifier and local-network-record lessons where they become useful.

Technical practice followed by investigation

Follow a password spray into the records

Open the password-spraying activity in a new tab →

Sit at Dave's laptop and try to get into Elm Street Motors' accounts two ways: lots of passwords against one account, then one password against every account. Watch what the sign-in service's lockout does with each. Then swap sides and use the sign-in log, sessions and account activity to spot the spray, rule out an office printer retrying an old password, and follow the one sign-in that worked.

Follow a DNS lookup, then investigate a wrong answer

Open the DNS activity in a new tab →

Follow a computer's DNS request through its resolver, the DNS hierarchy and the returned answer. Compare local and resolver caching, then investigate a workshop's report of an unexpected website using preserved DNS, browser and connection records.

  • Duration: 20–25 minutes
  • Format: six tasks; a DNS lookup experiment followed by a records-based investigation exercise
  • Your role: establish what happened and what evidence to obtain; no repair of the affected system

The activity applies how DNS lookups work, how cached answers are reused and what DNS can establish about a website visit.

Guided mechanism exercise

Inside a phishing website

A colleague has followed an email link to a copied sign-in page. Step into Dave’s setup: connect the form, follow the submitted details, see the redirect and test what the captured password lets him do. Then connect the actions to the records an investigator would seek.

Open guided phishing exercise in a new tab →

Explore the phishing environment without questions in a new tab →

  • Duration: 15–20 minutes guided; explore at your own pace
  • Format: a guided mechanism and interpretation exercise, or open exploration of the same model
  • Starting point: the email link has already been followed; email preparation and delivery are reserved for a separate linked activity

The exercise applies how fake login pages work and how entry, submission, receipt and later use differ.

Investigation exercises

Practise interpreting records, preparing useful enquiries and explaining what the results establish. These exercises can also support a taught session or a short course.

From seizure to report: follow a phone through examination

Open investigation exercise in a new tab →

Follow Lena Cross's phone from the night of the Harbour Room assault to the day its report arrives. Decide how the seized phone is kept, write the examination request and have it accepted or returned by triage, answer the examiner's questions, read the acquisition log and match the report back to what you asked for.

  • Duration: 20–30 minutes
  • Format: seven stages with a live case file and a request builder
  • Leads into: the reader exercise below, using the report this exercise produces
  • For managers: shows what an unfocused request costs the unit and the case

Examine a mobile extraction reader

Work the Harbour Room assault enquiry using a searchable reader, source-linked exhibits and three guided A/B comparisons: a missing photograph, a deleted-message label and attribution from device to person. Bookmark evidence and export a reproducible finding.

From public IP to subscriber return

Open investigation exercise in a new tab →

Work from a retailer event through a registration result and a precise provider enquiry prepared for an authorised intermediary, then interpret the subscriber reply and choose the next useful enquiries.

  • Duration: 12–18 minutes
  • Format: six guided tasks and a case debrief using supplied records
  • Evidence boundary: the provider response stays locked until the request is complete

The exercise applies the IP investigation walkthrough and the guidance on interpreting subscriber results.

Follow a suspicious login through the records

Open investigation exercise in a new tab →

Leanne is worried that someone has obtained her saved documents. Pick up your colleague's enquiries, examine the account records, prepare a follow-up request and work out what the provider's reply adds.

  • Duration: 15–20 minutes
  • Format: five investigative tasks, investigation material and a returned provider reply
  • Evidence boundary: successful access and account actions do not identify the person controlling the session

The exercise applies the guidance on successful login events, session identifiers and authentication attribution.