Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository

September 12, 2026 · View on GitHub

Repository Features

  • Interactive Digital Forensics Labs: Designed to engage students and faculty
  • Linux-Centric Lab Environment: Uses Kali Linux exclusively in all labs
  • Visual Learning Support: Each lab includes PowerPoint presentations, associated files, and instructional screenshots
  • Holistic Coverage: Encompasses a wide array of topics within the field of digital forensics
  • Open-Source Tools: All tools used are free and open source
  • Ongoing Updates: Supported by grants from the DOJ, DHS, and NSF, the team is committed to regularly updating the repository
  • Forensic Intelligence Integration: Two structured forensic intelligence datasets in JSON format derived from real case studies

To provide feedback or tell us how you use the course materials, please email wxu at ubalt dot edu. Your collaboration is sincerely valued.

NEW Digital Forensics Basics: Second Edition and Companion Materials

The 649-page second edition of Digital Forensics Basics: A Step-by-Step Guide for Beginners builds on selected content from this repository, reorganizing and expanding it into a structured, chapter-by-chapter learning path for beginners, independent learners, and instructors.

A dedicated companion materials repository provides chapter-aligned presentations, downloadable lab and evidence files, expanded evidence-search materials, a Windows command-line tutorial, study and lab guidance, and curated tool references.

Faculty members are eligible for a complimentary desk copy. To request the PDF, please email ldeng at towson dot edu from your institutional email address and include a link to your faculty profile or university webpage.


Repository Materials: Table of Contents

The list below serves as the table of contents for this digital-forensics-lab repository, not for the book. It indexes the labs, presentations, case studies, datasets, and other instructional resources available here. (Latest noted repository addition: Eufy investigations, October 15, 2024.)

Tool Installation

Method 1: Importing a Customized Kali VM Image

The customized VM combines Kali Linux 2021.4 with the tools required to complete most of the labs listed above, except for the P2P data leakage case.

Method 2: Installing Tools Using the Customized Script

The script has been tested only on Kali Linux 2021.4. It installs the tools required to complete most of the labs listed above, except for the P2P data leakage case, which uses a separate script described in the presentations. Please let us know if you would like us to add more tools to the script.

wget  https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh
  • Review the installed tools. Most tool commands can be run globally, allowing you to skip many of the installation steps in the presentations.

Method 3: Using a Docker Container Based on Ubuntu 22.04 LTS

  • This method was added in September 2023 and may require additional testing. Please report any issues.
  • The Docker host runs Ubuntu 22.04 LTS.
  • The container is built on top of Ubuntu 22.04 LTS as well.
  • All tools are preinstalled in the Ubuntu container.
  • Follow the tutorial Docker for Digital Forensic Investigation.

Investigating NIST Data Leakage

This case study examines a forensic image involving intellectual property theft. It includes:

Topics Covered

LabsTopics Covered (Command Line)Python Version
Lab 0Environment Setup
Lab 1Windows Registry
Lab 2Windows Event and XMLPython version
Lab 3Web History and SQLPython version
Lab 4Email InvestigationPython version
Lab 5File Change History and USN Journal
Lab 6Network Evidence, Shellbags, and Jump Lists
Lab 7Network Drive and Cloud
Lab 8Master File Table (MFT)andLogFile(MFT) and Log File (LogFile) Analysis
Lab 9Windows Search History
Lab 10Windows Volume Shadow Copy Analysis and SQL Database Carving
Lab 11Recycle Bin and Anti-Forensics
Lab 12Data Carving
Lab 13Cracking Windows Passwords

Investigating P2P Data Leakage

The P2P data leakage case study helps students apply forensic techniques to an investigation of intellectual property theft involving peer-to-peer software. The study includes:

  • A large and complex case involving a uTorrent client. The case is similar to the NIST data leakage lab but provides a clearer, more detailed timeline.
  • Well-documented evidence and explanations connecting each activity to the timeline.
  • 10 hands-on digital forensics labs

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 0Lab Environment Setup4M
Lab 1Disk Image and Partitions5M
Lab 2Windows Registry and File Directory15M
Lab 3MFT Timeline6M
Lab 4USN Journal Timeline3M
Lab 5uTorrent Log File9M
Lab 6File Signature8M
Lab 7Emails9M
Lab 8Web History11M
Lab 9Website Analysis2M
Lab 10Timeline (Summary)13K

Investigating Illegal Possession of Images

This case study investigates the illegal possession of rhino images. The forensic image was contributed by Dr. Golden G. Richard III and was originally used in the DFRWS 2005 Rodeo Challenge. NIST hosts the USB DD image, and a copy is also available in this repository.

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 1Reviewing HTTP Analysis Using Wireshark (Text)3M
Lab 2Rhino Possession Investigation 1: File Recovery9M
Lab 3Rhino Possession Investigation 2: Steganography4M
Lab 4Rhino Possession Investigation 3: Extracting Evidence from FTP Traffic3M
Lab 5Rhino Possession Investigation 4: Extracting Evidence from HTTP Traffic5M

Investigating Email Harassment

This case study investigates a harassing email sent by a student to a faculty member. The case is hosted by Digital Corpora, where you can access the scenario description and network traffic. This repository provides only the lab instructions.

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 0Investigating a Harassing Email Using Wireshark3M
Lab 1Introduction to TShark Forensics7M
Lab 2Investigating a Harassing Email Using TShark2M

Investigating an Illegal File Transfer

This case study examines computer memory to reconstruct a timeline of unauthorized data transfers. The scenario involves the illicit transfer of sensitive files from a server to a USB device.

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 0Memory Forensics11M
Part 1Understanding the Suspect and Accounts
Part 2Understanding the Suspect's PC
Part 3Network Forensics
Part 4Investigating Command History
Part 5Investigating the Suspect's USB Device
Part 6Investigating Internet Explorer History
Part 7Investigating File Explorer History
Part 8Timeline Analysis

Investigating a Hacking Case

This case study, which includes a disk image provided by NIST, investigates a hacker who intercepts internet traffic within range of wireless access points.

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 0Hacking Case8M

Investigating the Morris Worm Attack

This case study investigates the Morris worm attack using a VM provided by SEED Labs. The goal is to identify all evidence related to the attack.

Topics Covered

LabsTopics CoveredSize of PPTs
Lab 0Morris Worm Attack7M
Lab 1Investigating Morris Worm Attack2M

Investigating Eufy Doorbell

This case study examines a Eufy doorbell and HomeBase system using advanced forensic extraction techniques, including the chip-off method. The process begins with disassembly and chip removal, continues through image acquisition, and concludes with analysis. Key directories containing camera footage, SQLite databases, and various logs are analyzed to extract evidence. This approach helps reconstruct timelines, identify user interactions and system activity, and provide valuable insights for security investigations. This study focuses on HomeBase 2, although HomeBase 3 is now available.

eMMC Image

Topics Covered

LabsTopics Covered
Lab 0Doorbell Introduction
Lab 1Doorbell Scenario Simulation
Lab 2Doorbell Teardown and Chip-Off Image Acquisition
Lab 3Doorbell Image Analysis and Mounting
Lab 4Doorbell Evidence Extraction
Lab 5Doorbell P2P Communication Log
Lab 6Doorbell Daily (Sec) Log
Lab 7Analyzing the Doorbell Camera Directory
Lab 8Analyzing the Doorbell SQLite Directory

Investigating Echo Show 8

This case study demonstrates the use of the chip-off technique to extract evidence from a second-generation Amazon Echo Show 8. Several types of evidence are generated and placed on the device. The investigation uses reverse-engineering techniques to recover that evidence from the Echo Show's embedded MultiMediaCard (eMMC).

eMMC Images

Topics Covered

LabsTopics CoveredLab Data
Lab 0Echo Show Introduction
Lab 1Echo Show Evidence Planting
Lab 2Device Teardown and eMMC Chip-off
Lab 3Image Acquisition and Mounting
Lab 4.1.1Specifications: Device and OS InformationLink
Lab 4.1.2Specifications: User InformationLink
Lab 4.1.3Specifications: Network Connectivity InformationLink
Lab 4.2.1Web ActivityLink
Lab 4.2.2Phone CommunicationLink
Lab 4.3.1Multimedia: Photos and Related DataLink
Lab 4.3.2Multimedia: Videos and Related DataLink
Lab 4.3.3Multimedia: Audio and Related DataLink

Investigating Android 10

The image was created by Joshua Hickman and is hosted by Digital Corpora.

LabsTopics CoveredSize of PPTs
Lab 0Introduction to the Pixel 33M
Lab 1Pixel 3 Image2M
Lab 2Pixel 3 Device4M
Lab 3Pixel 3 System Settings5M
Lab 4Overview: App Lifecycle11M
Lab 5.1.1AOSP App Investigations: Messaging4M
Lab 5.1.2AOSP App Investigations: Contacts3M
Lab 5.1.3AOSP App Investigations: Calendar1M
Lab 5.2.1GMS App Investigations: Messaging6M
Lab 5.2.2GMS App Investigations: Dialer2M
Lab 5.2.3GMS App Investigations: Maps8M
Lab 5.2.4GMS App Investigations: Photos6M
Lab 5.3.1Third-Party App Investigations: Kik4M
Lab 5.3.2Third-Party App Investigations: TextNow1M
Lab 5.3.3Third-Party App Investigations: WhatsApp3M
Lab 6Pixel 3 Rooting5M

Investigating iPhone iOS 13.4.1

The image was created by Joshua Hickman and is hosted by Digital Corpora.

LabsTopics CoveredSize of PPTs
Lab 0Introduction to iPhone iOS 135M
Lab 1iOS 13.4.1 Image5M
Lab 2iPhone Device Investigation3M
Lab 3iOS System Settings3M
Lab 4Overview of the App Lifecycle2M
Lab 5Messages Investigation3M
Lab 6Contacts Investigation3M
Lab 7Calendar Investigation2M
Lab 8Safari Investigation3M
Lab 9Photo Investigation7M
Lab 10KnowledgeC Investigation5M
Lab 11Health Investigation5M
Lab 12Location Investigation8M
Lab 13Cellebrite Investigation12M
Lab 14Magnet AXIOM Investigation13M
Lab 15Jailbreak Investigation6M

Investigating a DJI Drone

The dataset includes logical files extracted from a DJI controller (mobile device) and an image of the SD card used by the device. The drone dataset was created by VTO Labs. The lab covers GPS analysis and cached-image retrieval. This lab is a draft and will be improved in a future update.

LabsTopics CoveredSize of PPTs
Lab 0DJI Mavic Air Mobile13M
Lab 1DJI Mavic Air MicroSD Raw2M
Lab 2DJI Mavic Air MicroSD EnCase Format2M

Political Insight Analysis Leveraging LLMs

This case study demonstrates how to leverage large language models to derive political insights from an email dataset. It uses a set of leaked emails obtained from Hillary Clinton's private email server.

The leaked emails represent a significant chapter in recent U.S. political history and raise questions about transparency, security, and the handling of sensitive information. During her tenure as U.S. Secretary of State from 2009 to 2013, Hillary Clinton used a private email server for official communications instead of the State Department's email system. She stated that she did so for convenience, allowing her to use a single device for both personal and official emails.

The dataset from Hillary Clinton's private email server is a comprehensive collection of communications covering her tenure as Secretary of State from 2009 to 2013. It includes approximately 30,000 emails on topics ranging from official diplomatic communications to personal correspondence. The release and subsequent analysis of these emails have played a significant role in political debates, legal inquiries, and public discussions about transparency and security in government communications.

Our dataset is a set of email summaries. Each summary was generated by Gemini from an original message in the leaked email dataset. This case study focuses only on emails containing the keyword Israel.

Our results and code are available in a Jupyter Notebook.

The following image presents political insights derived from summaries of emails related to Israel:

Tools

NameCommandRepositoryInstallation Method
Winewine --versionhttps://source.winehq.org/git/wine.git/Custom
Vinettovinetto -hhttps://github.com/AtesComp/VinettoCustom
imgclipimgclip -hhttps://github.com/Arthelon/imgclipapt install
RegRipperrip.pl -hhttps://github.com/keydet89/RegRipper3.0Customized script
Windows-Prefetch-Parserprefetch.py -hhttps://github.com/PoorBillionaire/Windows-Prefetch-Parser.gitCustom
python-evtxevtx_dump.py -hhttps://github.com/williballenthin/python-evtxapt install
libesedb-utilsesedbexport -hhttps://github.com/libyal/libesedbapt install
libpffpffexport -hhttps://github.com/libyal/libpffapt install
USN-Record-Carverusncarve.py -hhttps://github.com/PoorBillionaire/USN-Record-Carverapt install
USN-Journal-Parserusn.py -hhttps://github.com/PoorBillionaire/USN-Journal-Parserapt install
time_decodetime_decode.py -hhttps://github.com/digitalsleuth/time_decodeGit clone
analyzeMFTanalyzeMFT.py -hhttps://github.com/dkovar/analyzeMFTCustomized script
libvshadowvshadowinfo -hhttps://github.com/libyal/libvshadowCustomized script
INDXParseINDXParse.py -Customized script
Carving SQLite database filesundark -hhttps://github.com/inflex/undark.gitCustomized script
stegdetectstegdetect -VCustomized script
stegbreakstegbreak -VCustomized script
stego-toolkitjphideCustomized script
jpsestego-toolkitekjpseekCustomized script
volatility-2vol.py -hhttps://github.com/volatilityfoundation/volatility.gitCustomized script
liblnk-utilslnkinfo -hapt install
JLECmdhttps://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zipGit clone
recentfilecache-parserhttps://github.com/prolsen/recentfilecache-parser
LogFileParserhttps://github.com/jschicht/LogFileParser.gitGit clone
UsnJrnl2Csvttps://github.com/jschicht/UsnJrnl2Csv.gitGit clone
  • Other tools installed using apt install: python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus

Citing This Repository

If you use this repository's labs, datasets, or instructional materials in your work, please cite it as follows:

Frank Xu and contributors. Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository. GitHub. https://github.com/frankwxu/digital-forensics-lab.

@misc{xu_digital_forensics_lab,
  author       = {Xu, Frank and {contributors}},
  title        = {Digital Forensics Lab \& Shared Cyber Forensic Intelligence Repository},
  howpublished = {GitHub},
  url          = {https://github.com/frankwxu/digital-forensics-lab}
}

Include the date you accessed the repository and, when applicable, the commit hash of the version you used.

Contributors

  • Principal investigators

    • Dr. Frank Xu (Email: fxu at ubalt dot edu)
    • Dr. Debra L. Stanley
    • Dr. Lin Deng; Towson University
    • Dr. Wenbin Zhang; Florida International University

  • Students:

    • Eric Xu: University of Maryland (LLM for Digital Forensics)
    • Jeel Khatiwala (Evaluating the Reliability of Digital Forensic Evidence Discovered by LLMs)
    • Mohit Dhabuwala (Open-source mobile forensics handbook)
    • Daniel Addai (CTF)
    • Sarfraz Shaikh (Echo Show, Eufy Doorbell)
    • Danny Ferreira (iPhone)
    • Harleen Kaur (Partial Android contribution)
    • Malcolm Hayward (P2P Leakage)
    • Richard (Max) Wheeless (Hacking case)
    • Chimezie Onwuegbuchulem (Docker for Digital Forensics)
    • Etinosa Osawe (AI for Forensics—identifying IP addresses with a fine-tuned language model)

Star History

GitHub stars

Star history chart showing GitHub stars over time for frankwxu/digital-forensics-lab