Forensic disk images

by

The list includes many PC disk images, but also memory images, network packets, mobile phone and drone image data, and email data.

Image data provided by NIST for forensics

The CFReDS Project

This is a forensic dataset provided by NIST called “Computer Forensic Reference Data Sets (CFReDS)”. It’s probably one of the most famous data sets for forensic training.

  • Hacking Case
    You analyze a laptop’s disk image and gather evidence to answer 31 questions. The answer file is ready.
    Download 2 files “EnCase image” and “second part” and open “.E01” with a forensic tool such as FTK Imager.
  • Data Leakage Case
    You analyze 1 PC and 3 removable media and gather evidence to answer 60 questions. The answer file is ready.
  • Registry Forensics
    Image files for Registry Analysis exercise.
  • Drone Images
    Images from 60 drones including the DJI Phantom 4, and associated controllers, connected mobile devices and computers.
  • Russian Tea Room
    Disk image for Russian environment analysis. Your goal is to find eight sections.
  • Basic Mac image
    Disk image for Mac environment analysis. There are no specific scenarios.
  • Mobile Device Images
    Images from 10 mobile devices including the Samsung S4. There are no specific scenarios.
  • Container Files
    An image of the container environment. There are no specific scenarios.
  • Deleted File Recovery
    Metadata based deleted file recovery images.
  • File Carving
    Basic file carving images.

Technical — ENISA