Courses / Disk Forensics
Journal-Aware Timeline Lab
Practice rebuilding user stories when journals truncate and logs disagree.
Schedule a workshop callOverview
Intermediate disk learners work through contradictory signals introduced on purpose. You document reconciliation steps instead of forcing a single story.
What is included
- Two contradiction archetypes with solution keys released after attempt
- Office hours on reconciliation prose
- Optional pair lab with shared notes doc
- Rubric for “admitted uncertainty” paragraphs
Outcomes
- Write a reconciliation memo for a provided contradiction pack
- Identify at least one alternate hypothesis you must still rule out
FAQ
Prerequisite?
Disk Forensics Walkthrough or equivalent experience.
Tools?
Same viewer stack as the walkthrough course.
Honest scope
Linux journal deep dives are preview-only here.
Learner notes
-
“Contradiction packs felt mean in the best way—finally not toy-perfect data.”
-
“Pair lab option saved me when I stalled on memo tone.”