mirror of
https://github.com/frankwxu/digital-forensics-lab.git
synced 2026-04-10 12:13:44 +00:00
78 lines
2.1 KiB
Markdown
78 lines
2.1 KiB
Markdown
# Digital Forensics Lab
|
|
Free Hands-on Digital Forensics Labs for Students and Faculty
|
|
---
|
|
|
|
## Table of Contents (updating)
|
|
- Case Study
|
|
* [NIST Data Leakage](#Nist%20Data%20Leakage)
|
|
* [Email Harassment](#Email%20Harassment)
|
|
* [Illegel Image Possesion](#Illegel%20Image%20Possesion)
|
|
- [Tools Used](#Tools%20used)
|
|
|
|
|
|
---
|
|
### NIST Data Leakage
|
|
==============
|
|
|
|
The case study is to investigate an image involving intellectual property theft. The study include
|
|
|
|
* A large and complex image created by [NIST](https://www.cfreds.nist.gov/data_leakage_case/data-leakage-case.html)
|
|
* 13 hands-on labs/topics in digital forensics
|
|
* Each lab has an PPT with lab screenshots
|
|
|
|
Topics Covered
|
|
|
|
| Labs | Topics Covered |
|
|
| --- | ----------- |
|
|
| Lab 0 | Environment Setting Up |
|
|
| Lab 1 | Windows Registry |
|
|
| Lab 2 | Windows Event and XML |
|
|
| Lab 3 | Web History and SQL |
|
|
| Lab 4 | Email Investigation |
|
|
| Lab 5 | File Change History and USN Journal |
|
|
| Lab 6 | Network Evidence and shellbag |
|
|
| Lab 7 | Network Drive and Windows shellbag |
|
|
| Lab 8 | $MFT (Master File Table) Analysis |
|
|
| Lab 9 | Windows Search History |
|
|
| Lab 10 | Windows Volume Shadow Copy Analysis |
|
|
| Lab 11 | Data Carving |
|
|
|
|
|
|
|
|
---
|
|
### Email Harassment
|
|
=========
|
|
---
|
|
### Illegel Image Possesion
|
|
============
|
|
---
|
|
### Tools used
|
|
========
|
|
* Wine
|
|
* https://github.com/AtesComp/Vinetto
|
|
* https://github.com/Arthelon/imgclip
|
|
* Tree (apt-get install tree)
|
|
* https://github.com/keydet89/RegRipper3.0
|
|
* https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git
|
|
* apt-get install python3-evtx
|
|
* apt-get install xmlstarlet
|
|
* apt-get install libhivex-bin
|
|
* apt-get install libesedb-utils
|
|
* apt-get install pasco
|
|
* https://github.com/libyal/libpff apt-get install pff-tools
|
|
* pip install usncarve
|
|
* pip install usnparser
|
|
* JLECmd wget https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip
|
|
* apt-get install liblink-tuils
|
|
* https://github.com/digitalsleuth/time_decode
|
|
* pip install analyzeMFT
|
|
* https://github.com/libyal/libvshadow
|
|
* https://github.com/prolsen/recentfilecache-parser
|
|
|
|
|
|
## Contribution
|
|
=============
|
|
* Frank Xu
|
|
* Malcolm Hayward
|
|
* Richard (Max) Wheeless
|