Free hands-on digital forensics labs for students and faculty
Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository
Repository Features
- Interactive Digital Forensics Labs: Designed to engage students and faculty
- Linux-Centric Lab Environment: Uses Kali Linux exclusively in all labs
- Visual Learning Support: Each lab includes PowerPoint presentations, associated files, and instructional screenshots
- Holistic Coverage: Encompasses a wide array of topics within the field of digital forensics
- Open-Source Tools: All tools used are free and open source
- Ongoing Updates: Supported by grants from the DOJ, DHS, and NSF, the team is committed to regularly updating the repository
- Forensic Intelligence Integration: Two structured forensic intelligence datasets in JSON format derived from real case studies
To provide feedback or tell us how you use the course materials, please email wxu at ubalt dot edu. Your collaboration is sincerely valued.
Digital Forensics Basics: Second Edition and Companion Materials
The 649-page second edition of Digital Forensics Basics: A Step-by-Step Guide for Beginners builds on selected content from this repository, reorganizing and expanding it into a structured, chapter-by-chapter learning path for beginners, independent learners, and instructors.
A dedicated companion materials repository provides chapter-aligned presentations, downloadable lab and evidence files, expanded evidence-search materials, a Windows command-line tutorial, study and lab guidance, and curated tool references.
Faculty members are eligible for a complimentary desk copy. To request the PDF, please email ldeng at towson dot edu from your institutional email address and include a link to your faculty profile or university webpage.
Repository Materials: Table of Contents
The list below serves as the table of contents for this digital-forensics-lab repository, not for the book. It indexes the labs, presentations, case studies, datasets, and other instructional resources available here. (Latest noted repository addition: Eufy investigations, October 15, 2024.)
Basic Computer Skills for Digital Forensics
- Number Systems (Python data-conversion code added in January 2023)
- PC Introduction
- Windows Command Line Tutorial
- Linux Command Line Tutorial
- Advanced Linux Command Line Tutorial
Computer and Digital Forensics (updated in October 2021)
Basic Networking Skills for Digital Forensics (added on March 17, 2023; uses the Python Scapy and NetfilterQueue libraries)
Computer Forensics Case Studies
- Investigating NIST Data Leakage (Windows XP)
- Investigating P2P Data Leakage (Windows 10)
- Investigating Illegal Possession of Images ("Networking forensics")
- Investigating Email Harassment (updated in February 2023)
- Investigating an Illegal File Transfer (Memory Forensics)
- Investigating a Hacking Case
- Investigating the Morris Worm Attack (updated in January 2023; poster)
Mobile/IoT Forensics Case Studies
- Investigating Eufy Doorbell (added on October 15, 2024)
- Investigating Echo Show 8 (added on December 25, 2023)
- Investigating Android 10 (added on October 24, 2021)
- Investigating iPhone iOS 13 (updated on June 18, 2022)
- Investigating a DJI Drone (added on December 7, 2021)
Forensic Intelligence Repository
AI for Forensics
Investigating Group Crimes Using Cellebrite's 2022 Capture-the-Flag (CTF) Competition Dataset. Faculty members may request PDF lab instructions.
- Beth's iPhone
- Heisenberg's Android phone
- Marsha's iPhone
Tool Installation
Method 1: Importing a Customized Kali VM Image
The customized VM combines Kali Linux 2021.4 with the tools required to complete most of the labs listed above, except for the P2P data leakage case.
- Install VirtualBox.
- Import the customized Kali Linux 2021.4 VM. The default virtual disk size is 80 GB.
Method 2: Installing Tools Using the Customized Script
The script has been tested only on Kali Linux 2021.4. It installs the tools required to complete most of the labs listed above, except for the P2P data leakage case, which uses a separate script described in the presentations. Please let us know if you would like us to add more tools to the script.
Install VirtualBox.
Install Kali Linux 2021.4. We recommend configuring the VM with an 80 GB virtual disk because each data-leakage case image may exceed 30 GB.
Follow the tool-installation instructions, or run the commands below:
wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh
- Review the installed tools. Most tool commands can be run globally, allowing you to skip many of the installation steps in the presentations.
Method 3: Using a Docker Container Based on Ubuntu 22.04 LTS
- This method was added in September 2023 and may require additional testing. Please report any issues.
- The Docker host runs Ubuntu 22.04 LTS.
- The container is built on top of Ubuntu 22.04 LTS as well.
- All tools are preinstalled in the Ubuntu container.
- Follow the tutorial Docker for Digital Forensic Investigation.
Investigating NIST Data Leakage
This case study examines a forensic image involving intellectual property theft. It includes:
- A large and complex case created by NIST. The NIST website provides the scenario and DD/EnCase images, as well as the solutions.
- 14 hands-on digital forensics labs
Topics Covered
| Labs | Topics Covered (Command Line) | Python Version |
|---|---|---|
| Lab 0 | Environment Setup | |
| Lab 1 | Windows Registry | |
| Lab 2 | Windows Event and XML | Python version |
| Lab 3 | Web History and SQL | Python version |
| Lab 4 | Email Investigation | Python version |
| Lab 5 | File Change History and USN Journal | |
| Lab 6 | Network Evidence, Shellbags, and Jump Lists | |
| Lab 7 | Network Drive and Cloud | |
| Lab 8 | Master File Table ($MFT) and Log File ($LogFile) Analysis | |
| Lab 9 | Windows Search History | |
| Lab 10 | Windows Volume Shadow Copy Analysis and SQL Database Carving | |
| Lab 11 | Recycle Bin and Anti-Forensics | |
| Lab 12 | Data Carving | |
| Lab 13 | Cracking Windows Passwords |
Investigating P2P Data Leakage
The P2P data leakage case study helps students apply forensic techniques to an investigation of intellectual property theft involving peer-to-peer software. The study includes:
- A large and complex case involving a uTorrent client. The case is similar to the NIST data leakage lab but provides a clearer, more detailed timeline.
- Well-documented evidence and explanations connecting each activity to the timeline.
- 10 hands-on digital forensics labs
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Lab Environment Setup | 4M |
| Lab 1 | Disk Image and Partitions | 5M |
| Lab 2 | Windows Registry and File Directory | 15M |
| Lab 3 | MFT Timeline | 6M |
| Lab 4 | USN Journal Timeline | 3M |
| Lab 5 | uTorrent Log File | 9M |
| Lab 6 | File Signature | 8M |
| Lab 7 | Emails | 9M |
| Lab 8 | Web History | 11M |
| Lab 9 | Website Analysis | 2M |
| Lab 10 | Timeline (Summary) | 13K |
Investigating Illegal Possession of Images
This case study investigates the illegal possession of rhino images. The forensic image was contributed by Dr. Golden G. Richard III and was originally used in the DFRWS 2005 Rodeo Challenge. NIST hosts the USB DD image, and a copy is also available in this repository.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 1 | Reviewing HTTP Analysis Using Wireshark (Text) | 3M |
| Lab 2 | Rhino Possession Investigation 1: File Recovery | 9M |
| Lab 3 | Rhino Possession Investigation 2: Steganography | 4M |
| Lab 4 | Rhino Possession Investigation 3: Extracting Evidence from FTP Traffic | 3M |
| Lab 5 | Rhino Possession Investigation 4: Extracting Evidence from HTTP Traffic | 5M |
Investigating Email Harassment
This case study investigates a harassing email sent by a student to a faculty member. The case is hosted by Digital Corpora, where you can access the scenario description and network traffic. This repository provides only the lab instructions.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Investigating a Harassing Email Using Wireshark | 3M |
| Lab 1 | Introduction to TShark Forensics | 7M |
| Lab 2 | Investigating a Harassing Email Using TShark | 2M |
Investigating an Illegal File Transfer
This case study examines computer memory to reconstruct a timeline of unauthorized data transfers. The scenario involves the illicit transfer of sensitive files from a server to a USB device.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Memory Forensics | 11M |
| Part 1 | Understanding the Suspect and Accounts | |
| Part 2 | Understanding the Suspect's PC | |
| Part 3 | Network Forensics | |
| Part 4 | Investigating Command History | |
| Part 5 | Investigating the Suspect's USB Device | |
| Part 6 | Investigating Internet Explorer History | |
| Part 7 | Investigating File Explorer History | |
| Part 8 | Timeline Analysis |
Investigating a Hacking Case
This case study, which includes a disk image provided by NIST, investigates a hacker who intercepts internet traffic within range of wireless access points.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Hacking Case | 8M |
Investigating the Morris Worm Attack
This case study investigates the Morris worm attack using a VM provided by SEED Labs. The goal is to identify all evidence related to the attack.
Topics Covered
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Morris Worm Attack | 7M |
| Lab 1 | Investigating Morris Worm Attack | 2M |
Investigating Eufy Doorbell
This case study examines a Eufy doorbell and HomeBase system using advanced forensic extraction techniques, including the chip-off method. The process begins with disassembly and chip removal, continues through image acquisition, and concludes with analysis. Key directories containing camera footage, SQLite databases, and various logs are analyzed to extract evidence. This approach helps reconstruct timelines, identify user interactions and system activity, and provide valuable insights for security investigations. This study focuses on HomeBase 2, although HomeBase 3 is now available.
eMMC Image
Topics Covered
| Labs | Topics Covered |
|---|---|
| Lab 0 | Doorbell Introduction |
| Lab 1 | Doorbell Scenario Simulation |
| Lab 2 | Doorbell Teardown and Chip-Off Image Acquisition |
| Lab 3 | Doorbell Image Analysis and Mounting |
| Lab 4 | Doorbell Evidence Extraction |
| Lab 5 | Doorbell P2P Communication Log |
| Lab 6 | Doorbell Daily (Sec) Log |
| Lab 7 | Analyzing the Doorbell Camera Directory |
| Lab 8 | Analyzing the Doorbell SQLite Directory |
Investigating Echo Show 8
This case study demonstrates the use of the chip-off technique to extract evidence from a second-generation Amazon Echo Show 8. Several types of evidence are generated and placed on the device. The investigation uses reverse-engineering techniques to recover that evidence from the Echo Show's embedded MultiMediaCard (eMMC).
eMMC Images
Topics Covered
| Labs | Topics Covered | Lab Data |
|---|---|---|
| Lab 0 | Echo Show Introduction | |
| Lab 1 | Echo Show Evidence Planting | |
| Lab 2 | Device Teardown and eMMC Chip-off | |
| Lab 3 | Image Acquisition and Mounting | |
| Lab 4.1.1 | Specifications: Device and OS Information | Link |
| Lab 4.1.2 | Specifications: User Information | Link |
| Lab 4.1.3 | Specifications: Network Connectivity Information | Link |
| Lab 4.2.1 | Web Activity | Link |
| Lab 4.2.2 | Phone Communication | Link |
| Lab 4.3.1 | Multimedia: Photos and Related Data | Link |
| Lab 4.3.2 | Multimedia: Videos and Related Data | Link |
| Lab 4.3.3 | Multimedia: Audio and Related Data | Link |
Investigating Android 10
The image was created by Joshua Hickman and is hosted by Digital Corpora.
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Introduction to the Pixel 3 | 3M |
| Lab 1 | Pixel 3 Image | 2M |
| Lab 2 | Pixel 3 Device | 4M |
| Lab 3 | Pixel 3 System Settings | 5M |
| Lab 4 | Overview: App Lifecycle | 11M |
| Lab 5.1.1 | AOSP App Investigations: Messaging | 4M |
| Lab 5.1.2 | AOSP App Investigations: Contacts | 3M |
| Lab 5.1.3 | AOSP App Investigations: Calendar | 1M |
| Lab 5.2.1 | GMS App Investigations: Messaging | 6M |
| Lab 5.2.2 | GMS App Investigations: Dialer | 2M |
| Lab 5.2.3 | GMS App Investigations: Maps | 8M |
| Lab 5.2.4 | GMS App Investigations: Photos | 6M |
| Lab 5.3.1 | Third-Party App Investigations: Kik | 4M |
| Lab 5.3.2 | Third-Party App Investigations: TextNow | 1M |
| Lab 5.3.3 | Third-Party App Investigations: WhatsApp | 3M |
| Lab 6 | Pixel 3 Rooting | 5M |
Investigating iPhone iOS 13.4.1
The image was created by Joshua Hickman and is hosted by Digital Corpora.
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | Introduction to iPhone iOS 13 | 5M |
| Lab 1 | iOS 13.4.1 Image | 5M |
| Lab 2 | iPhone Device Investigation | 3M |
| Lab 3 | iOS System Settings | 3M |
| Lab 4 | Overview of the App Lifecycle | 2M |
| Lab 5 | Messages Investigation | 3M |
| Lab 6 | Contacts Investigation | 3M |
| Lab 7 | Calendar Investigation | 2M |
| Lab 8 | Safari Investigation | 3M |
| Lab 9 | Photo Investigation | 7M |
| Lab 10 | KnowledgeC Investigation | 5M |
| Lab 11 | Health Investigation | 5M |
| Lab 12 | Location Investigation | 8M |
| Lab 13 | Cellebrite Investigation | 12M |
| Lab 14 | Magnet AXIOM Investigation | 13M |
| Lab 15 | Jailbreak Investigation | 6M |
Investigating a DJI Drone
The dataset includes logical files extracted from a DJI controller (mobile device) and an image of the SD card used by the device. The drone dataset was created by VTO Labs. The lab covers GPS analysis and cached-image retrieval. This lab is a draft and will be improved in a future update.
| Labs | Topics Covered | Size of PPTs |
|---|---|---|
| Lab 0 | DJI Mavic Air Mobile | 13M |
| Lab 1 | DJI Mavic Air MicroSD Raw | 2M |
| Lab 2 | DJI Mavic Air MicroSD EnCase Format | 2M |
Political Insight Analysis Leveraging LLMs
This case study demonstrates how to leverage large language models to derive political insights from an email dataset. It uses a set of leaked emails obtained from Hillary Clinton's private email server.
The leaked emails represent a significant chapter in recent U.S. political history and raise questions about transparency, security, and the handling of sensitive information. During her tenure as U.S. Secretary of State from 2009 to 2013, Hillary Clinton used a private email server for official communications instead of the State Department's email system. She stated that she did so for convenience, allowing her to use a single device for both personal and official emails.
The dataset from Hillary Clinton's private email server is a comprehensive collection of communications covering her tenure as Secretary of State from 2009 to 2013. It includes approximately 30,000 emails on topics ranging from official diplomatic communications to personal correspondence. The release and subsequent analysis of these emails have played a significant role in political debates, legal inquiries, and public discussions about transparency and security in government communications.
Our dataset is a set of email summaries. Each summary was generated by Gemini from an original message in the leaked email dataset. This case study focuses only on emails containing the keyword Israel.
Our results and code are available in a Jupyter Notebook.
The following image presents political insights derived from summaries of emails related to Israel: 
Tools
| Name | Command | Repository | Installation Method |
|---|---|---|---|
| Wine | wine --version | https://source.winehq.org/git/wine.git/ | Custom |
| Vinetto | vinetto -h | https://github.com/AtesComp/Vinetto | Custom |
| imgclip | imgclip -h | https://github.com/Arthelon/imgclip | apt install |
| RegRipper | rip.pl -h | https://github.com/keydet89/RegRipper3.0 | Customized script |
| Windows-Prefetch-Parser | prefetch.py -h | https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git | Custom |
| python-evtx | evtx_dump.py -h | https://github.com/williballenthin/python-evtx | apt install |
| libesedb-utils | esedbexport -h | https://github.com/libyal/libesedb | apt install |
| libpff | pffexport -h | https://github.com/libyal/libpff | apt install |
| USN-Record-Carver | usncarve.py -h | https://github.com/PoorBillionaire/USN-Record-Carver | apt install |
| USN-Journal-Parser | usn.py -h | https://github.com/PoorBillionaire/USN-Journal-Parser | apt install |
| time_decode | time_decode.py -h | https://github.com/digitalsleuth/time_decode | Git clone |
| analyzeMFT | analyzeMFT.py -h | https://github.com/dkovar/analyzeMFT | Customized script |
| libvshadow | vshadowinfo -h | https://github.com/libyal/libvshadow | Customized script |
| INDXParse | INDXParse.py - | Customized script | |
| Carving SQLite database files | undark -h | https://github.com/inflex/undark.git | Customized script |
| stegdetect | stegdetect -V | Customized script | |
| stegbreak | stegbreak -V | Customized script | |
| stego-toolkit | jphide | Customized script | |
| jpsestego-toolkitek | jpseek | Customized script | |
| volatility-2 | vol.py -h | https://github.com/volatilityfoundation/volatility.git | Customized script |
| liblnk-utils | lnkinfo -h | apt install | |
| JLECmd | https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip | Git clone | |
| recentfilecache-parser | https://github.com/prolsen/recentfilecache-parser | ||
| LogFileParser | https://github.com/jschicht/LogFileParser.git | Git clone | |
| UsnJrnl2Csv | ttps://github.com/jschicht/UsnJrnl2Csv.git | Git clone |
- Other tools installed using
apt install: python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus
Contributors
Principal investigators
- Dr. Frank Xu (Email: fxu at ubalt dot edu)
- Dr. Debra L. Stanley
- Dr. Lin Deng; Towson University
- Dr. Wenbin Zhang; Florida International University
Students:
- Eric Xu: University of Maryland (LLM for Digital Forensics)
- Jeel Khatiwala (Evaluating the Reliability of Digital Forensic Evidence Discovered by LLMs)
- Mohit Dhabuwala (Open-source mobile forensics handbook)
- Daniel Addai (CTF)
- Sarfraz Shaikh (Echo Show, Eufy Doorbell)
- Danny Ferreira (iPhone)
- Harleen Kaur (Partial Android contribution)
- Malcolm Hayward (P2P Leakage)
- Richard (Max) Wheeless (Hacking case)
- Chimezie Onwuegbuchulem (Docker for Digital Forensics)
- Etinosa Osawe (AI for Forensics—identifying IP addresses with a fine-tuned language model)
