Guide 1: Encoding, Hashing, and Metadata Investigation
A beginner-friendly practical guide for learning how encoding, hashing, file metadata, and privacy inspection are used in cybersecurity and digital forensics.
Completion status
Overview
A practical first lab for cybersecurity and digital forensics
In this guide, you will investigate a simple message and a file using common cybersecurity and digital forensics tools. You will encode text, generate hashes, compare changes, and inspect metadata. The goal is not only to get the answer, but to understand what the output means.
Explain why encoding is not the same as encryption.
Convert simple text into Base64 and hexadecimal format.
Generate a hash for text and files.
Compare two hashes to check whether data has changed.
Inspect file metadata and understand why metadata can create privacy risks.
Understand how digital forensic investigators use hashes and metadata during evidence handling.
How to use this guide
Work through each task step by step
- Read each task carefully.
- Open the linked tool when instructed.
- Copy your result into the answer box.
- Think about what the result means.
- Mark the guide as complete when finished.
Tools used
Open the existing MuhammadLab tools as you work
Task 1
Encode a message using Base64
Use the Base64 Encoder / Decoder tool to encode a short sentence and observe how the representation changes.
Message to encode
Cybersecurity is about protecting data.
Tool to use
Expected student action
Encode the message and paste the Base64 result into the answer box.
Reflection question
Is Base64 encryption? Why or why not?
Optional hint
Base64 is an encoding method. It changes how data is represented, but it does not protect the message with a secret key.
Task 2
Convert text to hexadecimal
Use hexadecimal output to see how readable text becomes compact byte-style notation.
Word to convert
Forensics
Tool to use
Expected student action
Convert the word into hex and paste the result into the answer box.
Reflection question
Why might digital systems represent data in hexadecimal format?
Optional hint
Hexadecimal is a compact way to represent binary data.
Task 3
Generate a text hash
Use the Hash Generator to compare how a tiny text change affects a SHA-256 hash.
Texts to hash
1. Evidence file received 2. Evidence file received.
Tool to use
Expected student action
Generate SHA-256 for both lines and paste both hashes into the answer box.
Reflection question
Only one full stop was added. What happened to the hash, and what does this tell you?
Optional hint
A small change in input should produce a very different hash. This is useful for checking whether data has changed.
Task 4
Compare two hashes
Take the two SHA-256 values from Task 3 and compare them with the checksum comparison tool.
Use the two hashes from Task 3
Hash A and Hash B from the previous task
Tool to use
Expected student action
Write whether the hashes match or do not match.
Reflection question
How can hash comparison help a digital forensic investigator?
Optional hint
Investigators can use hashes to verify that a file has not changed during collection, transfer, or analysis.
Task 5
Inspect file metadata
Create a simple local file and inspect what metadata and identifying details appear before the content is even opened.
Create this file
Filename: student-note.txt Contents: This is my first digital forensics lab.
Expected student action
Write down the file name, file size, file type or MIME type if shown, and SHA-256 hash if shown.
Reflection question
What kind of information can metadata reveal about a file?
Optional hint
Metadata can include file name, size, type, timestamps, author fields, software used, and sometimes location or device information depending on the file type.
Task 6
Inspect a file signature
Use the same text file to look at magic bytes or signature data that help identify the real file type.
Use the same file
student-note.txt
Tool to use
Expected student action
Write what file signature or magic bytes are shown, if available.
Reflection question
Why is the file signature more reliable than only looking at the file extension?
Optional hint
A file extension can be renamed, but the actual file header may reveal the real file type.
Task 7
Image privacy check
Inspect a JPEG image you have permission to use and see whether hidden metadata is present.
Use any JPEG image you are allowed to inspect
Look for device/camera info, timestamp, GPS or location, and software data.
Tool to use
Expected student action
Write whether the image contains metadata such as device/camera information, timestamp, GPS/location information, or software information.
Reflection question
Why can image metadata be a privacy risk before sharing photos online?
Optional hint
Some images may contain location, device, date, or software information.
Task 8
Remove image metadata
If the image contains metadata, generate a cleaner version and compare what changed.
Use the same JPEG image from Task 7
Compare the original image metadata with the cleaned export.
Tool to use
Expected student action
Write what changed after removing metadata.
Reflection question
Why is metadata removal useful for privacy?
Optional hint
It reduces the amount of hidden personal or technical information shared with the file.
Mini summary
What this first lab connected together
In this guide, you used encoding, hashing, checksum comparison, file metadata inspection, file signature analysis, and image privacy tools. These are basic but important skills in cybersecurity and digital forensics. Encoding helps represent data, hashing helps verify integrity, and metadata inspection helps identify hidden information inside files.
Knowledge check
Quick quiz with immediate feedback
Answer the questions below to check whether the main ideas are starting to stick.
1. Which statement is correct about Base64?
2. What is the main purpose of a hash in digital forensics?
3. What usually happens when one character in the input changes before hashing?
4. Why can metadata be a privacy risk?
5. Why is a file signature useful?
Completion
Finish the lab and save your progress locally
Next guide
Guide 2: Passwords, Tokens, and Secure Randomness
Continue with passwords, tokens, randomness, and safe handling of authentication secrets.