This repository contains a collection of hands-on digital forensics labs focused on Linux, Windows, mobile, and network environments. The labs emphasize practical techniques used in real-world investigations such as timeline reconstruction, artifact recovery, user activity correlation, and memory analysis.
-
Applying the Daubert Standard to Forensic Evidence
Examines the admissibility of forensic techniques using legal standards for scientific reliability. -
Recognizing the Use of Steganography in Image and Audio Files
Identifies and analyzes hidden data embedded in multimedia files. -
Recovering Deleted and Damaged Files
Demonstrates data recovery through file carving and hex-level analysis. -
Conducting an Incident Response Investigation
Documents key steps in live response and post-breach evidence collection. -
Forensic Investigations on Windows Systems
Investigates Windows-specific artifacts like registry keys, logs, and application usage traces. -
Forensic Investigations on Linux Systems
Analyzes bash history, system logs, cron jobs, and shell artifact correlation. -
Email and Chat Log Analysis
Examines metadata, headers, and message content for signs of tampering or exfiltration. -
Mobile Device Forensics
Focuses on device acquisition, application artifact recovery, and location data interpretation. -
Network Infrastructure Forensics
Analyzes router, firewall, and DHCP logs to identify compromise patterns and unauthorized access. -
System Memory Forensics
Extracts volatile data, running processes, injected code, and registry fragments from live memory.
- SleuthKit (
fls,istat,mactime) auditdandausearch- Memory analysis utilities
- File carving tools and hex editors
- Linux and Windows command-line forensics
- Timeline reconstruction and user behavior profiling
Michael Twining
Cybersecurity Researcher | Digital Forensics & Incident Response | GitHub: @usrtem
📫 michael.twining@outlook.com
🌐 LinkedIn | YouTube
This project is licensed under the Creative Commons Attribution 4.0 International License.