RawCopy Hands on Labs¶

Choose the Interactive Lab for a guided browser investigation without installation, or use the Full Lab to collect and verify real training evidence in a Windows VM.

Interactive Lab¶

The interactive terminal requires JavaScript. The complete real tool Full Lab below remains available.

Full Lab¶

Isolated Windows VM

RawCopy Full Lab

Real tool and training evidence

Hands on Proof of Concept

Collect it. Verify it. Hand it over.

Create a harmless document, collect the NTFS file catalogue, and prepare evidence another analyst can trace back to your source.

Start the Full Lab

Outcome led, not screenshot led

Your file size, hash, timestamps and record numbers will differ from the synthetic browser results. Record what your VM actually produces. Allow about 45-60 minutes after setup.

Use an isolated, authorised environment

Create the test document only on a disposable Windows VM. Snapshot it first. These exercises intentionally change the training source and perform live collection; never run the preparation commands on original case evidence.

Before you begin

You need: an x64 Windows VM with NTFS C:, administrator access, RawCopy, a separate writable evidence disk mapped to E:, and MFT Explorer or a compatible MFT parser. Check actual free space and output requirements; allow several GB for this small exercise.

How to use this lab

Use Command Prompt, save a notebook on E:, and return after each linked procedure. Adapt drive letters consistently. Stop at any failed checkpoint instead of continuing with unverified evidence.

Recommended first

Beginner Core Lab¶

One VM, one known document, one live $MFT collection, hash verification and a parser review.

Optional extension

Repeat from an image¶

Use a verified raw training image and its confirmed NTFS volume. Compare acquisition context and derived outputs.

Session 1Build and seed
Session 2Collect and verify
Session 3Review and report

Objective¶

You support case RC-1042 on WIN-LAB01. The case owner asks whether the file catalogue contains a known handover document. Establish a positive control (a file you deliberately create) and a negative control (a unique name you never create), then document what a collected $MFT can and cannot show. The browser story practises collection for a missing file investigation; this real tool route uses a retained file so beginners have a predictable check.

01

Activity 1: Build the environment¶

Prepare and snapshot a disposable Windows VM. Record hostname, OS, source volume, clock/time zone, evidence disk identity and snapshot name.
Follow Install and prepare. Record the official RawCopy download, executable hash and displayed version. Record the parser source and version too.
Create the case folders on E:. Save notes outside the source volume.
On this training VM only, create a harmless positive control:

mkdir C:\RC-Training
echo RC-1042 harmless training document> C:\RC-Training\handover-RC1042.txt
dir C:\RC-Training

Record the full path and creation time. Choose never-created-RC1042-control.txt as the negative control; do not create it. Keep the positive file in place until after collection.

Milestone 1Known baseline readyThe tool opens, the source and destination are identified, and the controlled file exists.

Expected result Your notebook predicts one positive filename and one absent control before extraction.

02

Activity 2: Collect and verify¶

Scope is recordedDocument why the training collection is live, the selected C: volume and $MFT source, and the separate destination.
The command is preservedFollow Collect and retain the log. Record exact parameters and start/end times with time zone.
The result is plausibleInspect the console log for failures. Record the collected filename and byte count; retain VolInfo.txt.
The bytes are verifiedFollow Hash and create a working copy. Compare the two SHA-256 values before analysis.

Checkpoint: the two hash outputs have different paths. Is that a failure?

No. Compare the digest values, not the headings or paths. If the digest values differ, preserve the discrepancy and stop. Retry the copy into a fresh destination; do not silently replace the original evidence or recorded hash.

Milestone 2Traceable collectionBinary, log, context, byte count and matching working copy hash are retained.

Expected result A nonempty collected MFT and a working copy have matching SHA-256 digests, with no unexplained collection errors.

03

Activity 3: Review and report¶

Open only the verified working copy in MFT Explorer, or follow MFT2CSV for a CSV workflow.
Find handover-RC1042.txt. Record its full path, file reference, allocated/deleted status and relevant timestamps with the parser's time zone. Save an export or screenshot with input hash and parser version.
Search for never-created-RC1042-control.txt. Record the query and actual result. Investigate an unexpected match rather than forcing the expected answer.
Compare the observed path and metadata with your preparation notes. A missing positive control calls for checking source volume, collection timing, parser errors and filters.
Explain the result: a matching catalogue record supports the file's recorded presence. It does not prove execution, document contents, exfiltration, or a particular user's intent. An absent search result is limited to the collected data and search method.

Case and question: RC-1042
Operator, hostname, source volume and live-collection justification:
Tool version/hash, exact command, start/end times and time zone:
Output path, byte count, collection errors and volume information:
Original SHA-256, working-copy SHA-256 and verification time:
Parser version, input hash and export location:
Positive control: path, reference, status, timestamps:
Negative control: query and observed result:
Supported conclusion, limitations and next evidence to examine:
Cleanup and snapshot recovery:

Milestone 3Finding documentedAnother analyst can connect the observation to the source, collection and verified working copy.

Expected result The positive control is found, the negative control is absent, and the report distinguishes observation from attribution.

Extend the working core: image based extraction

Acquire a training image using your validated imaging workflow, preserve hashes, and identify the correct NTFS volume from its partition map. Follow the image extraction example using a new output directory. Hash the derived MFT, create a working copy and repeat the controls. Live and later image based outputs need not hash identically because the source may have changed. Explain that timing difference.

Full Lab evidence checklist¶

This checklist records the real tool Full Lab. For the Interactive Lab, download its synthetic evidence summary instead. Mark an item only after saving it.

Core completion¶

Required for a reviewable evidence set.
- Authorised source, destination, snapshot and time zone recorded.
- Download source, RawCopy version and executable hash retained.
- Positive and negative control predictions documented.
- Exact command, start/end times, log and volume information saved.
- Output byte count and matching original/working-copy SHA-256 recorded.
- Parser version, input hash, queries and observed results retained.
- Bounded conclusion, limitations and next check written.
- Evidence preserved and training VM cleanup/recovery confirmed.

0 of 8 recorded Mark each item when its evidence is saved.

Troubleshooting and cleanup¶

If collection or parsing fails, follow the troubleshooting checks and retain the failure logs. Save the case package outside any VM snapshot being reverted. Remove only the harmless training material you created, restore the disposable VM to its recorded baseline, and confirm retained evidence is still accessible.