This guide provides step-by-step instructions for completing all 3 Media Protection labs. Each lab presents a real-world scenario involving removable media that contains Federal Contract Information (FCI): classifying it, sanitizing it for reuse, and deciding the correct disposition for end-of-life equipment.
In these labs you will work with simulated removable media. Each "USB drive" is a virtual disk file (.vhdx) in your pod folder, and a contents listing published next to it shows everything on that drive. You will inspect what is on the media, decide whether it contains FCI, sanitize media so it can be safely reused, and complete the paperwork (logs, certificates, worksheets) that an assessor would ask to see.
The key lesson of this family: deleting files is not sanitization — media must be classified, sanitized by an approved method, and documented before it is reused or disposed of.
These labs align with CMMC Level 1 Media Protection (MP) requirements:
They also reinforce ACS-POL-MP-001 (the company media handling policy referenced in your artifacts) and the media inventory/classification practices that support it.
You will connect to the lab through Apache Guacamole — a web-based remote desktop gateway. There is nothing to install; everything runs in your web browser.
student01student05student12| Connection Name | What It Is |
|---|---|
| PODXX-SRV | Your own pod member server — use this for all MP labs |
This is the only connection you get: every MP lab is done on this desktop.
studentXX@acs-p01.local (or ACS-P01\studentXX) with your domain passwordTip: Press Ctrl+Alt+Shift to open the Guacamole side menu (to return Home or switch connections).
Option 1: Click the "Check Your Progress — Pod XX" banner at the top of the Guacamole interface.
Option 2: Go directly to https://training.status.tcecure.com/pod/XX (replace XX with your pod number).
C:\CyberLab\Pod03\MP-Artifacts\)Alternative method using PowerShell:
powershell, press Enterexplorer "C:\CyberLab\Pod03\MP-Artifacts" (replace 03 with your pod number)| File | What It Is |
|---|---|
MP-Lab-Instructions.txt |
Short summary of all three labs |
PXX-FCI-USB.vhdx |
Simulated USB drive that contains contract data |
PXX-Employee-Handbook.vhdx |
Simulated USB drive with general company documents |
PXX-FCI-USB-Contents.txt, PXX-Employee-Handbook-Contents.txt |
Full contents listing of each drive, including hidden items — read these instead of mounting |
MediaInventory.xlsx |
Media inventory spreadsheet |
MediaClassificationWorksheet.docx |
Worksheet you fill in for M1-L1 |
MediaClassificationResponses.csv |
Your graded answer file for M1-L1 |
MediaDisposalPolicy.pdf |
Policy reference (ACS-POL-MP-001) |
MediaSanitizationLog.csv |
Graded answer file for M1-L2 |
MediaSanitizationCertificate.csv |
Graded answer file for M1-L2 |
MP-M1-L2_SeedMetadata.json |
Do not edit or delete |
LaptopAssetRecord.csv, ChainOfCustody.csv, VendorDestructionCertificate.txt |
Evidence for M1-L3 |
MP-M1-L3_DispositionWorksheet.csv |
Graded answer file for M1-L3 |
_LAB_READY_MP-M1-*.txt |
Markers confirming the lab was seeded |
Important: Do not delete the original evidence files or the
_LAB_READY_/SeedMetadatafiles. Fill in the CSV answer files in place (the checker reads those exact file names).
The graded answer files are CSVs with the header row and blank cells already in place. Either:
.csv type)Do not rename the columns, and do not add extra header rows.
Everything in your pod is prefixed with your pod number so your work stays separate from other students. If you are Pod 03, your prefix is P03:
C:\CyberLab\Pod03\MP-Artifacts\P03-FCI-USB.vhdx (media ID P03-FCI-USB)P03-Employee-Handbook.vhdxP03-LAP-017, drive serial SN-P03-88421VDC-P03-2026-017Throughout this guide, replace XX with your pod number and PXX with your pod prefix.
A .vhdx file behaves like a physical USB drive. Mounting one is an
administrator operation on Windows, and on this shared server student accounts
are deliberately not administrators — so for this cohort you do not mount the
media yourself. Each drive image ships with a full contents listing that was
captured from the mounted media, and you classify and document from that.
C:\CyberLab\PodXX\MP-Artifacts\PXX-FCI-USB-Contents.txtPXX-Employee-Handbook-Contents.txtOr in PowerShell:
Get-Content C:\CyberLab\PodXX\MP-Artifacts\PXX-FCI-USB-Contents.txt
If you try to mount a
.vhdxyou will get "A required privilege is not
held by the client", or Windows will ask for administrator credentials that
your account does not have. That is expected — use the contents listing
instead. Nothing is broken and no lab credit depends on mounting.
Difficulty: Beginner | Time: 25 minutes | Type: Media inspection + worksheet
Two USB drives were found in an unlocked desk drawer at ACS Consulting. Before either one can be reused, stored, or thrown away, you must determine whether it holds Federal Contract Information. FCI is information provided by or generated for the government under a contract that is not intended for public release.
PXX-FCI-USB.vhdxPXX-Employee-Handbook.vhdxMediaInventory.xlsx, MediaClassificationWorksheet.docx, MediaDisposalPolicy.pdfMediaClassificationResponses.csvRead the policy first:
MediaDisposalPolicy.pdf and note how the policy defines FCI and what handling it requiresInspect the first drive:
PXX-FCI-USB-Contents.txtContracts, Purchase Orders, Drawings, Invoices, General Office, and the hidden Hidden Archive and Temp foldersFA-2026-PXXInspect the second drive:
PXX-Employee-Handbook-Contents.txtPolicies\Employee-Handbook.txt, Benefits\Benefits-Guide.txt, General Office\Holiday-Calendar.txtComplete the worksheet:
MediaClassificationWorksheet.docx and record, for each drive, what you found and why it does or does not meet the FCI definitionMediaInventory.xlsx so your media IDs match the inventoryRecord your graded answers in MediaClassificationResponses.csv:
| Column | What to enter |
|---|---|
Media |
Already filled in — leave as is |
Classification |
FCI for the FCI drive, Non-FCI for the handbook drive |
Evidence |
A specific sentence naming the file(s) that justify your classification (must be more than a few words) |
Example of a completed row (use your own findings):
PXX-FCI-USB.vhdx,FCI,Contracts\Federal-Services-Contract-2026.txt and Invoices\INV-2026-031.txt reference federal contract FA-2026-PXX
PXX-Employee-Handbook.vhdx,Non-FCI,Only general internal documents: employee handbook, benefits guide, holiday calendar
PXX-FCI-USB.vhdx is classified as FCIPXX-Employee-Handbook.vhdx is classified as Non-FCI.vhdx files are still present in the folderYou cannot protect FCI you have not identified. Media classification is the first step of MP.L1-3.8.3 — it decides which drives need sanitization or destruction later.
Difficulty: Intermediate | Time: 25 minutes | Type: Sanitization records
This cohort: re-creating and formatting a volume requires administrator
rights on this shared server, so the disk-management step is performed by the
instructor and is not graded. Read step 3 so you know how it is done, then
complete the log and certificate in step 5 — that is what is graded. When pods
move to their own servers you will perform the sanitization yourself.
PXX-FCI-USB is being reassigned to a non-federal project team. Before release for reuse it must be sanitized in accordance with ACS-POL-MP-001. A previous employee "sanitized" a drive by selecting the files and pressing Delete — the data was recovered by an auditor two weeks later. You will do it properly.
PXX-FCI-USB-Contents.txt (what is on the media today)MediaSanitizationLog.csv, MediaSanitizationCertificate.csvUnderstand what "sanitize" means:
Confirm what is on the media before it is sanitized (evidence for your log):
PXX-FCI-USB-Contents.txt and note the current volume label (PXX-FCI-MEDIA) and the folders presentHow the volume is re-created (reference for this cohort — administrator step, do not attempt): the volume is deleted and a new one created and fully formatted, not merely emptied.
Option A — Disk Management (GUI):
diskmgmt.msc, press EnterC:\CyberLab\PodXX\MP-Artifacts\PXX-FCI-USB.vhdx, click OKOption B — PowerShell:
$vhd = "C:\CyberLab\PodXX\MP-Artifacts\PXX-FCI-USB.vhdx"
Mount-DiskImage -ImagePath $vhd
$disk = Get-DiskImage -ImagePath $vhd | Get-Disk
# Remove the old volume and create a brand-new one
Clear-Disk -Number $disk.Number -RemoveData -Confirm:$false
Initialize-Disk -Number $disk.Number -PartitionStyle MBR -ErrorAction SilentlyContinue
$part = New-Partition -DiskNumber $disk.Number -UseMaximumSize -AssignDriveLetter
Format-Volume -Partition $part -FileSystem NTFS -NewFileSystemLabel "PXX-SANITIZED" -Full -Confirm:$false
# Confirm the volume is empty
Get-ChildItem -Path "$($part.DriveLetter):\" -Force
Dismount-DiskImage -ImagePath $vhd
(Replace PodXX / PXX with your pod values. -Full performs the overwriting format.)
Validation (performed with the sanitization): the label reads PXX-SANITIZED and the volume is empty apart from System Volume Information and $RECYCLE.BIN.
Complete MediaSanitizationLog.csv and MediaSanitizationCertificate.csv. Both files use the same columns and both must be filled in:
| Column | What to enter |
|---|---|
MediaId |
Leave as PXX-FCI-USB |
Method |
Clear or Purge (the method used on this media) |
Result |
Pass (replace Pending) |
Disposition |
Reuse |
SanitizedBy |
Your name |
Date |
The date the sanitization was performed, e.g., 2026-06-10 |
Clear or Purge, Pass, Reuse, a SanitizedBy name, and a valid dateMP-M1-L2_SeedMetadata.json is still present and unmodifiedMP.L1-3.8.3 requires sanitization before media is released for reuse. Deleted files remain recoverable, so an assessor tests the media and the records — which is exactly what this lab does.
Difficulty: Intermediate | Time: 25 minutes | Type: Document analysis + worksheet
Laptop PXX-LAP-017 from the Federal Programs group has failed diagnostics and reached end of life. Its drive held FCI. Facilities has already sent it out with a chain-of-custody record, and the vendor returned a certificate. Your job is to record the correct disposition decision and prove that the paperwork lines up.
LaptopAssetRecord.csvChainOfCustody.csvVendorDestructionCertificate.txtMP-M1-L3_DispositionWorksheet.csvRead the asset record (LaptopAssetRecord.csv):
PXX-LAP-017, owner Federal Programs, status End of lifeContainsFCI = YesDriveSerial = SN-PXX-88421Serviceability = Failed diagnosticsRead the chain of custody (ChainOfCustody.csv):
COC-PXX-017 shows the drive released by Jordan Lee to an approved destruction vendor for the purpose of DestructionRead the vendor certificate (VendorDestructionCertificate.txt):
VDC-PXX-2026-017, method Physical shredding, status DESTROYED, witnessedReason through the decision:
Complete MP-M1-L3_DispositionWorksheet.csv:
| Column | What to enter |
|---|---|
AssetId |
Leave as PXX-LAP-017 |
Decision |
Destroy |
DriveSerial |
SN-PXX-88421 (must match the asset and custody records) |
CertificateId |
VDC-PXX-2026-017 (must match the vendor certificate) |
Rationale |
At least a full sentence (20+ characters) explaining why destruction is required — cite the failed drive, the FCI content, and the vendor certificate |
Example rationale:
Drive failed diagnostics and cannot be reliably sanitized; the asset is end of life and held FCI, so destruction was performed and documented on certificate VDC-PXX-2026-017.
Decision is DestroyDriveSerial and CertificateId match the supporting records exactlyRationale is a complete justification, not a single wordMP.L1-3.8.3 gives you two valid outcomes for FCI media: sanitize it or destroy it. Choosing correctly — and being able to show matching custody and certificate records — is what turns a decision into audit evidence.
| Task | Where to Go |
|---|---|
| Open the artifacts folder | C:\CyberLab\PodXX\MP-Artifacts\ |
| Read what is on simulated media | Open PXX-<name>-Contents.txt in the artifacts folder |
| Open PowerShell | Windows + R → powershell |
| Check your lab progress | https://training.status.tcecure.com/pod/XX |
| Term | Meaning |
|---|---|
| FCI | Federal Contract Information — provided by or generated for the government under a contract, not for public release |
| Clear | Overwrite the media so standard recovery tools cannot retrieve the data |
| Purge | Stronger sanitization (degauss, cryptographic erase) that defeats laboratory recovery |
| Destroy | Physically render media unusable (shred, incinerate, disintegrate) |
| Chain of custody | Documented record of who held the media, when, and why |
| Mistake | Solution |
|---|---|
| Deleting files and calling it sanitization | Delete the volume and create a new one, then full-format it |
| Filling in only the sanitization log | The certificate must be completed with the same values |
Leaving Result as Pending |
Change it to Pass |
| One-word evidence or rationale | The checker requires real explanatory text |
Editing or deleting MP-M1-L2_SeedMetadata.json |
Leave it alone |
| Renaming the answer CSVs | Keep the exact file names; the checker looks for them |
| Missing hidden FCI in M1-L1 | The contents listing includes hidden items — read Hidden Archive and Temp |
.vhdx? Expected — cancel the prompt and read the -Contents.txt listing instead| Lab | Name | Status |
|---|---|---|
| M1-L1 | Classify the Media | ☐ |
| M1-L2 | Sanitize Media for Reuse | ☐ |
| M1-L3 | Decide the Disposition | ☐ |
After completing each lab:
C:\CyberLab\PodXX\MP-Artifacts\ with their original namesThis guide was created for the Digital Resilience Community Clinic (DRCC) Cyber Range.
CMMC Level 1 — Media Protection (MP) Module