Evidence and reports don't move between teams as loose files — they're bundled into a single compressed archive for transfer and chain of custody
Objective
Learner can create and extract tar archives and understand the distinction between archiving (tar) and compression (gzip)
Mission
Before shift handoff, package everything in ~/cases/case-1042/evidence/ into a single archive case-1042-evidence.tar.gz. Separately, extract suspicious archive ~/downloads/unknown-payload.tar.gz into ~/cases/case-1042/sandbox-inspect/ for inspection
Commands you may need to solve this lab
tar -czvftar -xzvf
Questions
Machine Offline
Isolated container is offline
Click "Start Machine" to boot your sandbox instance and choose your preferred interface