Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty.
Features Of Repository
Tool Installation (newly added on 12/6/2021)
Method 1: Importing customized Kali VM image
The customized Kali VM = Kali (2020.4) + tools used for completing most of the labs listed above (except p2p Data Leakage case)
Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2020.4)
The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.
wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh
Installed tools. Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.
Investigating NIST Data Leakage
The case study is to investigate an image involving intellectual property theft. The study include
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Environment Setting Up | 2M |
| Lab 1 | Windows Registry | 3M |
| Lab 2 | Windows Event and XML | 3M |
| Lab 3 | Web History and SQL | 3M |
| Lab 4 | Email Investigation | 3M |
| Lab 5 | File Change History and USN Journal | 2M |
| Lab 6 | Network Evidence and shellbag | 2M |
| Lab 7 | Network Drive and Cloud | 5M |
| Lab 8 | Master File Table ($MFT) and Log File ($logFile) Analysis | 13M |
| Lab 9 | Windows Search History | 4M |
| Lab 10 | Windows Volume Shadow Copy Analysis | 6M |
| Lab 11 | Recycle Bin and Anti-Forensics | 3M |
| Lab 12 | Data Carving | 3M |
| Lab 13 | Crack Windows Passwords | 2M |
Investigating P2P Data Leakage
The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Lab Environment Setting Up | 4M |
| Lab 1 | Disk Image and Partitions | 5M |
| Lab 2 | Windows Registry and File Directory | 15M |
| Lab 3 | MFT Timeline | 6M |
| Lab 4 | USN Journal Timeline | 3M |
| Lab 5 | uTorrent Log File | 9M |
| Lab 6 | File Signature | 8M |
| Lab 7 | Emails | 9M |
| Lab 8 | Web History | 11M |
| Lab 9 | Website Analysis | 2M |
| Lab 10 | Timeline (Summary) | 13K |
Investigating Illegal Possession of Images
The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | HTTP Analysis using Wireshark (text) | 3M |
| Lab 1 | HTTP Analysis using Wireshark (image) | 6M |
| Lab 2 | Rhion Possession Investigation 1: File recovering | 9M |
| Lab 3 | Rhion Possession Investigation 2: Steganography | 4M |
| Lab 4 | Rhion Possession Investigation 3: Extract Evidence from FTP Traffic | 3M |
| Lab 5 | Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic | 5M |
Investigating Email Harassment
The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Investigating Harassment Email using Wireshark | 3M |
| Lab 1 | t-shark Forensic Introduction | 2M |
| Lab 2 | Investigating Harassment Email using t-shark | 2M |
Investigating Illegal File Transferring
The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Memory Forensics | 11M |
| part 1 | Understand the Suspect and Accounts | |
| part 2 | Understand the Suspect’s PC | |
| part 3 | Network Forensics | |
| part 4 | Investigate Command History | |
| part 5 | Investigate Suspect’s USB | |
| part 6 | Investigate Internet Explorer History | |
| part 7 | Investigate File Explorer History | |
| part 8 | Timeline Analysis |
The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Hacking Case | 8M |
The image is created by Joshua Hickman and hosted by digital corpora.
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Intro Pixel 3 | 3M |
| Lab 1 | Pixel 3 Image | 2M |
| Lab 2 | Pixel 3 Device | 4M |
| Lab 3 | Pixel 3 System Setting | 5M |
| Lab 4 | Overview: App Life Cycle | 11M |
| Lab 5.1.1 | AOSP App Investigations: Messaging | 4M |
| Lab 5.1.2 | AOSP App Investigations: Contacts | 3M |
| Lab 5.1.3 | AOSP App Investigations: Calendar | 1M |
| Lab 5.2.1 | GMS App Investigations: Messaging | 6M |
| Lab 5.2.2 | GMS App Investigations: Dialer | 2M |
| Lab 5.2.3 | GMS App Investigations: Maps | 8M |
| Lab 5.2.4 | GMS App Investigations: Photos | 6M |
| Lab 5.3.1 | Third-Party App Investigations: Kik | 4M |
| Lab 5.3.2 | Third-Party App Investigations: textnow | 1M |
| Lab 5.3.3 | Third-Party App Investigations: whatapp | 3M |
| Lab 6 | Pixel 3 Rooting | 5M |
The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs. The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | DJI Mavic Air Mobile | 13M |
| Lab 1 | DJI Mavic Air MicroSD Raw | 2M |
| Lab 2 | DJI Mavic Air MicroSD Encase Format | 2M |
| Name | Command | Repository | Installation Method |
|---|---|---|---|
| Wine | wine –version | https://source.winehq.org/git/wine.git/ | Custom |
| Vinetto | vinetto -h | https://github.com/AtesComp/Vinetto | Custom |
| imgclip | imgclip -h | https://github.com/Arthelon/imgclip | apt install |
| RegRipper | rip.pl -h | https://github.com/keydet89/RegRipper3.0 | Customized scirpt |
| Windows-Prefetch-Parser | prefetch.py -h | https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git | Custom |
| python-evtx | evtx_dump.py -h | https://github.com/williballenthin/python-evtx | apt install |
| libesedb-utils | esedbexport -h | https://github.com/libyal/libesedb | apt install |
| libpff | pffexport -h | https://github.com/libyal/libpff | apt install |
| USN-Record-Carver | usncarve.py -h | https://github.com/PoorBillionaire/USN-Record-Carver | apt install |
| USN-Journal-Parser | usn.py -h | https://github.com/PoorBillionaire/USN-Journal-Parser | apt install |
| time_decode | time_decode.py -h | https://github.com/digitalsleuth/time_decode | Git clone |
| analyzeMFT | analyzeMFT.py -h | https://github.com/dkovar/analyzeMFT | Customized scirpt |
| libvshadow | vshadowinfo -h | https://github.com/libyal/libvshadow | Customized scirpt |
| INDXParse | INDXParse.py – | Customized scirpt | |
| carving sqlite .db | undark -h | https://github.com/inflex/undark.git | Customized scirpt |
| stegdetect | stegdetect -V | Customized scirpt | |
| stegbreak | stegbreak -V | Customized scirpt | |
| stego-toolkit | jphide | Customized scirpt | |
| jpsestego-toolkitek | jpseek | Customized scirpt | |
| volatility-2 | vol.py -h | https://github.com/volatilityfoundation/volatility.git | Customized scirpt |
| liblnk-utils | lnkinfo -h | apt install | |
| JLECmd | https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip | Git clone | |
| recentfilecache-parser | https://github.com/prolsen/recentfilecache-parser | ||
| LogFileParser | https://github.com/jschicht/LogFileParser.git | Git clone | |
| UsnJrnl2Csv | ttps://github.com/jschicht/UsnJrnl2Csv.git | Git clone |
shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…
Extract and execute a PE embedded within a PNG file using an LNK file. The…
Embark on the journey of becoming a certified Red Team professional with our definitive guide.…
This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…
This took me like 4 days (+2 days for an update), but I got it…
MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…