Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository

Repository Features

• Interactive Digital Forensics Labs: Designed to engage students and faculty
• Linux-Centric Lab Environment: Uses Kali Linux exclusively in all labs
• Visual Learning Support: Each lab includes PowerPoint presentations, associated files, and instructional screenshots
• Holistic Coverage: Encompasses a wide array of topics within the field of digital forensics
• Open-Source Tools: All tools used are free and open source
• Ongoing Updates: Supported by grants from the DOJ, DHS, and NSF, the team is committed to regularly updating the repository
• Forensic Intelligence Integration: Two structured forensic intelligence datasets in JSON format derived from real case studies

To provide feedback or tell us how you use the course materials, please email wxu at ubalt dot edu. Your collaboration is sincerely valued.

---

Digital Forensics Basics: Second Edition and Companion Materials

The 649-page second edition of Digital Forensics Basics: A Step-by-Step Guide for Beginners builds on selected content from this repository, reorganizing and expanding it into a structured, chapter-by-chapter learning path for beginners, independent learners, and instructors.

A dedicated companion materials repository provides chapter-aligned presentations, downloadable lab and evidence files, expanded evidence-search materials, a Windows command-line tutorial, study and lab guidance, and curated tool references.

Faculty members are eligible for a complimentary desk copy. To request the PDF, please email ldeng at towson dot edu from your institutional email address and include a link to your faculty profile or university webpage.

---

Repository Materials: Table of Contents

The list below serves as the table of contents for this digital-forensics-lab repository, not for the book. It indexes the labs, presentations, case studies, datasets, and other instructional resources available here. (Latest noted repository addition: Eufy investigations, October 15, 2024.)

• Basic Computer Skills for Digital Forensics

  • Number Systems (Python data-conversion code added in January 2023)
  • PC Introduction
  • Windows Command Line Tutorial
  • Linux Command Line Tutorial
  • Advanced Linux Command Line Tutorial

• Computer and Digital Forensics (updated in October 2021)

  • Introduction to Digital Forensics
  • Sleuth Kit Tutorial
  • USB Image Acquisition
  • Evidence Search - A Pattern Match Game (updated in May 2022)
  • Evidence Search - File Metadata
  • Data Carving
  • Steganography
  • Forensic Report Template

• Basic Networking Skills for Digital Forensics (added on March 17, 2023; uses the Python Scapy and NetfilterQueue libraries)

  • HTTP Analysis Using Wireshark (Text)
  • HTTP Analysis Using Wireshark (Image)
  • SYN Flood Attack Investigation Using TShark
  • SMTP Forensics
  • ARP Poisoning Forensics
  • Firewall
  • DNS Introduction
  • DNS Spoofing Forensics
  • WEP40 Wireless Aircrack

• Computer Forensics Case Studies

  • Investigating NIST Data Leakage (Windows XP)
  • Investigating P2P Data Leakage (Windows 10)
  • Investigating Illegal Possession of Images ("Networking forensics")
  • Investigating Email Harassment (updated in February 2023)
  • Investigating an Illegal File Transfer (Memory Forensics)
  • Investigating a Hacking Case
  • Investigating the Morris Worm Attack (updated in January 2023; poster)

• Mobile/IoT Forensics Case Studies

  • Investigating Eufy Doorbell (added on October 15, 2024)
  • Investigating Echo Show 8 (added on December 25, 2023)
  • Investigating Android 10 (added on October 24, 2021)
  • Investigating iPhone iOS 13 (updated on June 18, 2022)
  • Investigating a DJI Drone (added on December 7, 2021)

• Forensic Intelligence Repository

  • Email Forensics
  • Illegal Possession of Images

• AI for Forensics

  • CIKM 2024 tutorial session with an accompanying hands-on lab
  • Identifying IP Addresses Using a Fine-Tuned AI Model
  • Profiling Suspects Using LLMs (Browser History) (Colab version)
  • Political Insight Analysis Leveraging LLMs (Email)

• Investigating Group Crimes Using Cellebrite's 2022 Capture-the-Flag (CTF) Competition Dataset. Faculty members may request PDF lab instructions.

  • Beth's iPhone
  • Heisenberg's Android phone
  • Marsha's iPhone

---

Tool Installation

Method 1: Importing a Customized Kali VM Image

The customized VM combines Kali Linux 2021.4 with the tools required to complete most of the labs listed above, except for the P2P data leakage case.

• Install VirtualBox.
• Import the customized Kali Linux 2021.4 VM. The default virtual disk size is 80 GB.

Method 2: Installing Tools Using the Customized Script

The script has been tested only on Kali Linux 2021.4. It installs the tools required to complete most of the labs listed above, except for the P2P data leakage case, which uses a separate script described in the presentations. Please let us know if you would like us to add more tools to the script.

• Install VirtualBox.
• Install Kali Linux 2021.4. We recommend configuring the VM with an 80 GB virtual disk because each data-leakage case image may exceed 30 GB.
• Follow the tool-installation instructions, or run the commands below:

wget  https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh

• Review the installed tools. Most tool commands can be run globally, allowing you to skip many of the installation steps in the presentations.

Method 3: Using a Docker Container Based on Ubuntu 22.04 LTS

• This method was added in September 2023 and may require additional testing. Please report any issues.
• The Docker host runs Ubuntu 22.04 LTS.
• The container is built on top of Ubuntu 22.04 LTS as well.
• All tools are preinstalled in the Ubuntu container.
• Follow the tutorial Docker for Digital Forensic Investigation.

---

Investigating NIST Data Leakage

This case study examines a forensic image involving intellectual property theft. It includes:

• A large and complex case created by NIST. The NIST website provides the scenario and DD/EnCase images, as well as the solutions.
• 14 hands-on digital forensics labs

Topics Covered

---

Investigating P2P Data Leakage

The P2P data leakage case study helps students apply forensic techniques to an investigation of intellectual property theft involving peer-to-peer software. The study includes:

• A large and complex case involving a uTorrent client. The case is similar to the NIST data leakage lab but provides a clearer, more detailed timeline.
• Well-documented evidence and explanations connecting each activity to the timeline.
• 10 hands-on digital forensics labs

Topics Covered

---

Investigating Illegal Possession of Images

This case study investigates the illegal possession of rhino images. The forensic image was contributed by Dr. Golden G. Richard III and was originally used in the DFRWS 2005 Rodeo Challenge. NIST hosts the USB DD image, and a copy is also available in this repository.

Topics Covered

---

Investigating Email Harassment

This case study investigates a harassing email sent by a student to a faculty member. The case is hosted by Digital Corpora, where you can access the scenario description and network traffic. This repository provides only the lab instructions.

Topics Covered

---

Investigating an Illegal File Transfer

This case study examines computer memory to reconstruct a timeline of unauthorized data transfers. The scenario involves the illicit transfer of sensitive files from a server to a USB device.

Topics Covered

---

Investigating a Hacking Case

This case study, which includes a disk image provided by NIST, investigates a hacker who intercepts internet traffic within range of wireless access points.

Topics Covered

---

Investigating the Morris Worm Attack

This case study investigates the Morris worm attack using a VM provided by SEED Labs. The goal is to identify all evidence related to the attack.

Topics Covered

---

Investigating Eufy Doorbell

This case study examines a Eufy doorbell and HomeBase system using advanced forensic extraction techniques, including the chip-off method. The process begins with disassembly and chip removal, continues through image acquisition, and concludes with analysis. Key directories containing camera footage, SQLite databases, and various logs are analyzed to extract evidence. This approach helps reconstruct timelines, identify user interactions and system activity, and provide valuable insights for security investigations. This study focuses on HomeBase 2, although HomeBase 3 is now available.

eMMC Image

• Doorbell eMMC Image

Topics Covered

---

Investigating Echo Show 8

This case study demonstrates the use of the chip-off technique to extract evidence from a second-generation Amazon Echo Show 8. Several types of evidence are generated and placed on the device. The investigation uses reverse-engineering techniques to recover that evidence from the Echo Show's embedded MultiMediaCard (eMMC).

eMMC Images

• Echo Show eMMC Image
• Echo Show Userdata Partition Image

Topics Covered

---

Investigating Android 10

The image was created by Joshua Hickman and is hosted by Digital Corpora.

---

Investigating iPhone iOS 13.4.1

The image was created by Joshua Hickman and is hosted by Digital Corpora.

---

Investigating a DJI Drone

The dataset includes logical files extracted from a DJI controller (mobile device) and an image of the SD card used by the device. The drone dataset was created by VTO Labs. The lab covers GPS analysis and cached-image retrieval. This lab is a draft and will be improved in a future update.

---

Political Insight Analysis Leveraging LLMs

This case study demonstrates how to leverage large language models to derive political insights from an email dataset. It uses a set of leaked emails obtained from Hillary Clinton's private email server.

The leaked emails represent a significant chapter in recent U.S. political history and raise questions about transparency, security, and the handling of sensitive information. During her tenure as U.S. Secretary of State from 2009 to 2013, Hillary Clinton used a private email server for official communications instead of the State Department's email system. She stated that she did so for convenience, allowing her to use a single device for both personal and official emails.

The dataset from Hillary Clinton's private email server is a comprehensive collection of communications covering her tenure as Secretary of State from 2009 to 2013. It includes approximately 30,000 emails on topics ranging from official diplomatic communications to personal correspondence. The release and subsequent analysis of these emails have played a significant role in political debates, legal inquiries, and public discussions about transparency and security in government communications.

Our dataset is a set of email summaries. Each summary was generated by Gemini from an original message in the leaked email dataset. This case study focuses only on emails containing the keyword Israel.

Our results and code are available in a Jupyter Notebook.

The following image presents political insights derived from summaries of emails related to Israel:

---

Tools

• Other tools installed using apt install: python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus

---

Citing This Repository

If you use this repository's labs, datasets, or instructional materials in your work, please cite it as follows:

Frank Xu and contributors. Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository. GitHub. https://github.com/frankwxu/digital-forensics-lab.

@misc{xu_digital_forensics_lab,
  author       = {Xu, Frank and {contributors}},
  title        = {Digital Forensics Lab \& Shared Cyber Forensic Intelligence Repository},
  howpublished = {GitHub},
  url          = {https://github.com/frankwxu/digital-forensics-lab}
}

Include the date you accessed the repository and, when applicable, the commit hash of the version you used.

---

Contributors

• Principal investigators

  • Dr. Frank Xu (Email: fxu at ubalt dot edu)
  • Dr. Debra L. Stanley
  • Dr. Lin Deng; Towson University
  • Dr. Wenbin Zhang; Florida International University

• Students:

  • Eric Xu: University of Maryland (LLM for Digital Forensics)
  • Jeel Khatiwala (Evaluating the Reliability of Digital Forensic Evidence Discovered by LLMs)
  • Mohit Dhabuwala (Open-source mobile forensics handbook)
  • Daniel Addai (CTF)
  • Sarfraz Shaikh (Echo Show, Eufy Doorbell)
  • Danny Ferreira (iPhone)
  • Harleen Kaur (Partial Android contribution)
  • Malcolm Hayward (P2P Leakage)
  • Richard (Max) Wheeless (Hacking case)
  • Chimezie Onwuegbuchulem (Docker for Digital Forensics)
  • Etinosa Osawe (AI for Forensics—identifying IP addresses with a fine-tuned language model)

---

Star History