lab 01 · foundations

lab 1 · baseline & authorized acquisition

Stand up the toolchain, capture a clean baseline from a device you own, and learn why evidence integrity is a first-class concern.

90 minbeginneradbapts.sh

objective

Produce your first authorized, hashed evidence set and read it critically. By the end you can connect a device, run the triage collector, and explain what its FLAG lines do and do not prove.

materials

A throwaway Android device or emulator you may reset freely
Workstation with Android platform-tools
USB cable
apts.sh (download from any lab page)

procedure

Install Android platform-tools on the workstation and confirm adb version prints a build.
On the throwaway device, enable Developer Options (tap Build Number seven times), turn on USB debugging, connect USB, and accept the RSA prompt.

Confirm the examiner sees the device as authorized:

workstation

$ adb devices
// List of devices attached
// R58N... device

Run the triage collector and read its FLAG summary:
workstation
```
$ chmod +x apts.sh
$ ./apts.sh
```
Open the evidence directory it created (evidence_<serial>_<ts>/) and read three files by hand — do not rely on flags alone.
Record the integrity signals from the fingerprint: verifiedbootstate and bootloader lock. Note whether userspace evidence can be trusted.
Verify evidence integrity: confirm every file is listed in SHA256SUMS.

deliverable

Submit the evidence directory listing, the SHA256SUMS file, and a two-paragraph note: what integrity signals you observed, and whether they make the userspace evidence trustworthy. No findings required yet — this lab is about clean process.

why it matters

Absence of flags is not a clean bill of health. A baseline exists so that later labs have something to diff against — and so you practice the discipline of reading evidence rather than trusting a summary.