Linux02: Case File Triage

SOC tickets rarely stay in one clean folder. Analysts constantly stage working copies and archive stale material

Objective

Learner can create directories, copy files, and move files without losing originals

Case SOC-1042 just arrived in your ~/downloads/ folder as a raw evidence drop. Organize your workspace so your folders match this layout:

// What your folders should look like when done:

/home/student/

├── cases/

│ └── case-1042/

│ ├── archive/

│ │ └── old-notes.txt <-- Moved here from downloads

│ └── auth-dump.log <-- Copied here from downloads

└── downloads/

└── auth-dump.log <-- Keep original intact here

Make sure old-notes.txt is completely moved out of ~/downloads/, while the original auth-dump.log remains untouched in downloads

mkdircpmvls

1. Which command creates a new directory?

2. Which command duplicates a file while keeping the original?

3. Which command relocates a file, removing it from its original location?

Machine Offline

Isolated container is offline

Click "Start Machine" to boot your sandbox instance and choose your preferred interface