Digital Forensics Lab

Free Hands-on Digital Forensics Labs for Students and Faculty

Table of Contents (updating)

• Case Study
  • NIST Data Leakage
  • Email Harassment
  • Illegel Image Possesion
• Tools Used

---

NIST Data Leakage

==============

The case study is to investigate an image involving intellectual property theft. The study include

• A large and complex image created by NIST
• 13 hands-on labs/topics in digital forensics
• Each lab has an PPT with lab screenshots

Topics Covered

Labs	Topics Covered
Lab 0	Environment Setting Up
Lab 1	Windows Registry
Lab 2	Windows Event and XML
Lab 3	Web History and SQL
Lab 4	Email Investigation
Lab 5	File Change History and USN Journal
Lab 6	Network Evidence and shellbag
Lab 7	Network Drive and Windows shellbag
Lab 8	$MFT (Master File Table) Analysis
Lab 9	Windows Search History
Lab 10	Windows Volume Shadow Copy Analysis
Lab 11	Data Carving

---

Email Harassment

=========

Illegel Image Possesion

============

Tools used

========

• Wine
• https://github.com/AtesComp/Vinetto
• https://github.com/Arthelon/imgclip
• Tree (apt-get install tree)
• https://github.com/keydet89/RegRipper3.0
• https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git
• apt-get install python3-evtx
• apt-get install xmlstarlet
• apt-get install libhivex-bin
• apt-get install libesedb-utils
• apt-get install pasco
• https://github.com/libyal/libpff apt-get install pff-tools
• pip install usncarve
• pip install usnparser
• JLECmd wget https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip
• apt-get install liblink-tuils
• https://github.com/digitalsleuth/time_decode
• pip install analyzeMFT
• https://github.com/libyal/libvshadow
• https://github.com/prolsen/recentfilecache-parser

Contribution

=============

• Frank Xu
• Malcolm Hayward
• Richard (Max) Wheeless