ImageCacheViewer Hands-on Labs

Choose a lab

Choose the Interactive Lab for a short, guided browser exercise. Try the Full Lab after reviewing the tool guide and preparing an isolated, authorised environment.

How to use these labs

Start with the browser-based route to practise the workflow and evidence decisions without touching a real system. Use the Full Lab only in an isolated, authorised environment, and compare its outcome with the corresponding tool guide.

Interactive Lab

Browser-based · 10–20 min

ImageCacheViewer Interactive Lab

Expand labOpen in new tab

✓ No installation

Practise a guided ImageCacheViewer workflow in a safe browser simulation with immediate feedback.

I

Case SUSA-014: suspicious activityRecover a cached image and record its source URL and cache context.

Task 1 of 4

Safe simulationThis interface models a ImageCacheViewer workflow. It does not run the product, access an endpoint, or change evidence.

1. 1Source
2. 2Configure
3. 3Review
4. 4Explain

ImageCacheViewer · Browser artefact viewerSUSA training case / read-only simulation

Task 01 · Select evidence

Choose the authorised, traceable source

The case question is bounded. Select the item that preserves scope and provenance.

Copied Chrome profile · user analystPersonal browser profile on SUSAExported CSV with no profile context

Select a source to continue.

Full Lab

Self-hosted · 45–90 min

ImageCacheViewer Full Lab

Evidence required

Hands-on DFIR proof of concept

Prepare it. Examine it. Explain it.

Use ImageCacheViewer to recover a cached image and record its source URL and cache context, retain the evidence trail and write a bounded finding another analyst can review.

⏱ Setup and core exercise: 45–90 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Safety boundary

Use copied profiles. Do not open recovered links or downloads on the analyst workstation.

Evidence

a copied training browser profile or supplied browser artefact set

Success evidence

a browser observation linked to profile, source artefact, time context, and corroborating evidence

Recommended first

Beginner Core Lab

Complete one bounded ImageCacheViewer workflow using the documented source, settings and expected result.

Optional extension

Add a comparison

After the core succeeds, repeat the same focused task with one controlled change and explain the difference without widening the authorised scope.

Full Lab scenario

You are the first analyst reviewing a bounded training case. Your task is to recover a cached image and record its source URL and cache context. The result must be understandable to a second analyst who did not watch you perform the work.

01

Activity 1: Prepare the environment

1. Record the case question, authority and the identity of the isolated training system or evidence source.
2. Record the ImageCacheViewer version, provenance, system time and time zone.
3. Identify the original material, working location and separate output destination. Confirm that there is enough free space.
4. Take or verify a recoverable baseline before changing the training system.

Milestone 1Collection boundary readyThe authorised source, tool, time context, working location, destination and recovery point are recorded.

02

Activity 2: Complete the focused task

1. Restate the investigation question and select only the settings or commands required to recover a cached image and record its source URL and cache context.
2. Follow the preserved ImageCacheViewer guide and record any necessary difference in paths, labels or version-specific behaviour.
3. Record start and finish times, relevant settings, completion status, warnings and errors.
4. Preserve the returned output and keep it attributable to its source and collection context.

Milestone 2Focused result preservedThe selected workflow returned reviewable output without expanding beyond the authorised case question.

03

Activity 3: Review and report

1. Work from an identified copy and confirm a browser observation linked to profile, source artefact, time context, and corroborating evidence.
2. Separate direct tool observations from analyst interpretation. Record missing fields, unavailable material and alternative explanations.
3. Preserve relevant integrity information, settings or commands and the evidence needed for another analyst to reproduce the result.
4. Write a bounded conclusion with observation, interpretation, confidence and limitations, then clean up the disposable environment.

Milestone 3Finding ready for reviewAnother analyst can reproduce the workflow, locate the supporting output and understand what the result does and does not establish.

Full Lab evidence checklist

This checklist applies to the self-hosted Full Lab. If you completed the Interactive Lab, retain its browser evidence summary instead.

• Core completion

  Required to demonstrate a safe, attributable workflow.

  • Case question, authority, source identity, isolated environment and time context.
  • ImageCacheViewer version, provenance and relevant configuration.
  • Recorded source, working location and separate output destination.
  • Focused settings or commands used to recover a cached image and record its source URL and cache context.
  • Expected output, completion status and retained errors or warnings.
  • Observation, interpretation, confidence, limitations and alternative explanations.

• Good analyst practice

  Supplementary records that improve reproducibility and review quality.

  • Integrity information for retained output and an identified working copy.
  • Cleanup completed and disposable systems restored to their recorded baseline.

0 of 8 recorded Mark each item when you have saved the evidence.Reset

Clean up

Protect retained output and case notes, remove harmless training material, clear temporary credentials or access and restore disposable systems to their recorded baseline. Confirm that no test collection remains active.