This guide set walks through building a practical DFIR lab on a standalone ESXi host: network and hypervisor setup, NAS storage, FLARE Windows analysis VMs, artifact carving (EvtxECmd, Hayabusa, MFTECmd, Plaso JSONL—or KAPE for orchestration), and a single-node ELK stack so analysts can hunt timelines in Kibana.
Read 01 Introduction for architecture and principles, then follow the numbered guides through 06. Use 07 when exporting artifacts for ingest (including Plaso JSONL via Docker), 08 for operational habits (snapshots, scale, laptops).
Guides in this set
| Guide | Contents |
|---|---|
| 01 Introduction | Purpose, lab topology, IP baseline |
| 02 Limitations | Host RAM/VM counts and constraints |
| 03 ESXi deployment | Standalone ESXi and DFIR port group |
| 04 NAS deployment | Ubuntu NAS, Samba shares, mount policy |
| 05 ELK deployment | Elasticsearch, Logstash, Kibana, ingest |
| 06 Flare VM build | Windows FLARE workstation and NAS use |
| 07 Artifact carving | EvtxECmd, Hayabusa, MFTECmd, Plaso JSONL (Docker), ELK filenames (DESKTOP-EXAMPLE_*) |
| 08 Suggestions | Snapshots, scale, evidence handling |