Module 2 Seat-Time Justification
Module 2: Digital Data and Command-Line Foundations
Learn how operating systems identify files, examine raw hexadecimal data, and verify true file types through practical forensic analysis.
Total Seat Time
3 Hours 21 Minutes
Target Learner
Beginner Students
Delivery Format
Asynchronous Online Learning
Module Overview
In this module, students move beyond conceptual foundations and begin performing practical forensic analysis. Topics include storage abstraction layers, Windows Disk Management, command-line navigation, output redirection, DiskPart, hexadecimal representation, file signatures, and extension-disguise techniques commonly encountered during forensic examinations.
Lab Files & Downloads
Download the required files below before beginning the Module 2 hands-on lab. Save the files to your local computer and extract the contents before proceeding.
Learning Activities & Seat Time
| Activity | Estimated Time |
|---|---|
| Video Instruction | 21 Minutes |
| Technical Reading | 55 Minutes |
| Hands-On Lab | 105 Minutes |
| Module Quiz | 20 Minutes |
Estimation Method
Students will complete a practical forensic exercise involving the examination of 15 files using a hex viewer. The objective is to determine each file’s true type by analyzing its hexadecimal header rather than relying on the file extension displayed by the operating system.
Technical reading is estimated using a beginner technical-training pace rather than a casual reading pace. The module reading covers storage abstraction layers, Disk Management, command-line navigation, output redirection, DiskPart, hexadecimal representation, file signatures, and extension-disguise concepts. The 55-minute estimate assumes students are reading for comprehension and may pause to interpret terminology, command examples, storage diagrams, file-signature references, and beginner-level procedural details.
Module quiz is estimated at 20 minutes based on 10 open-book questions at 2 minutes per question.
Hands-on lab is estimated based on the required beginner-level workflow in the Module 2 practical exercise. The estimate includes lab setup, constructing the required matrix, inspecting every file in a hex viewer, researching file signatures, correcting working copies, verifying recovered content, and completing the LMS lab verification gate.
Hands-On Lab Time Breakdown
The Module 2 hands-on lab estimate is 105 minutes. The breakdown below reflects expected beginner learner time for the required lab workflow.
| Lab Task | Estimated Time |
|---|---|
| Download and extract lab data, stage tools, and run the setup process | 10 Minutes |
| Construct the six-column Forensic Triage Matrix | 10 Minutes |
| Open and inspect all 15 files in HxD or another hex viewer | 30 Minutes |
| Cross-reference file signatures and document true file types | 20 Minutes |
| Create working copies, correct disguised extensions, and verify contents | 20 Minutes |
| Complete the LMS lab verification gate using the completed matrix | 15 Minutes |
Lab Justification
The Module 2 lab is estimated at 105 minutes for a beginner learner because students must inspect all 15 files, manually record first-four-byte signatures, cross-reference file signature resources, identify mismatched extensions, create working copies, correct file extensions, open the corrected files, recover embedded verification data, and complete the LMS validation gate.
The lab directly supports the Module 2 objectives by requiring students to look past surface-level operating system labels, examine raw hexadecimal file headers, identify true file types using file signatures, and document their findings in a structured triage matrix. This is practical beginner-level forensic work rather than passive review.