Below are links to the various sets of data needed to complete the hands-on activities described in the Digital Forensics Workbook.
Chapter 4
Forensic Images.zip will contain the following files:
(These files are separated on this website to make the large files easier to download.)
drive1.E01 | MD5: 2ccfa510ee28712b01544594f4fad721 | SHA1: 2baa0524e34a684e615061829b21d6b33cd906f8
drive2.E01 | MD5: 977365ee7ec72480469c1d915e5974d2 | SHA1: 154efb62fd5515000d89d4b254e921c62edf342a
drive3.E01 | MD5: 994512dbe6759ae7766b0e2fe4d9ec8a | SHA1: b5da7ecdbf904e1cca65007858d2ee0807284c19
drive4.E01 | MD5: 3e81eb20ded1ae8c6ffc936d5613aacd | SHA1: e1d34bf072df9df86d864df675667ccd02c6840e
drive5.E01 | MD5: 36d849ecdeeb67e04911884346f93a15 | SHA1: 1b5891715365033800c632a4c19fd4770627dc2a
Chapter 5
drive1.E01 | MD5: 2ccfa510ee28712b01544594f4fad721 | SHA1: 2baa0524e34a684e615061829b21d6b33cd906f8
drive6.E01 | MD5: 5d0e7e310591ae12c71cfe9f20d4a159 | SHA1: a423753f2d77d29ad8b108ed753f820926c56a03
drive7.E01 | MD5: 0d444f8ee05e3307ffd41a3f5778007e | SHA1:ed6f77fabbe9b42efd0b0ef64473cf68229c35e9
drive9.E01 | MD5: 65688980010cfd427dc919d82cee6de3 | SHA1: 49dd38c17745a3d3c2d7141bdb2d116945c2d8f7
drive10.E01 | MD5: 43c767f06bce2029e2f88e698c41bd68 | SHA1: da3a6fefec3fb2d78004b393c94dacd46041c02f
drive11.E01 | MD5: 5cc3b71463f15902b274e223642c1938 | SHA1: 40c1b3e62989b53360d3025bc1a78a12abebc902
drive12.E01 | MD5: d66e113338ea992f993ddd786c591f4c | SHA1: 07319a10b2d134aa783d9175a5a81949472015b9
Chapter 6
drive2.E01 | MD5: 977365ee7ec72480469c1d915e5974d2 | SHA1: 154efb62fd5515000d89d4b254e921c62edf342a
drive.11.E01 | MD5: 5cc3b71463f15902b274e223642c1938 | SHA1: 40c1b3e62989b53360d3025bc1a78a12abebc902
Chapter 7
RegistryFiles-1.zip | MD5: 510d9b15811a4dd7fa0479561ec77bbf | SHA1: 1bcce20e1a47108a1fd5ccb84e5ec8d55a764299
RegistryFiles-2.zip | MD5: df2057351cc9c756ec80b3c82e9a0dba | SHA1: 02619818672f0ecf5aa5f5cbb639b58ce9c634cc
Chapter 8
File_Hashing_1.zip | MD5: 6f97b8fe74f422caf5cd8465ffbb2715 | SHA1: 89ee6f377c5e34e2a8826e8c373df9fe7980c91d
File_Hashing_2.zip | MD5: 78e7e4694387c8cceedfe4d14f2aa532 | SHA1: ccef865015b738ef68d5180be350ce78c62fa066
File_Hashing_3.zip | MD5: 2a4455208bde994354485a28bbc8fb06 | SHA1: 189e57827da6718046221f9a65510eaccfa6e732
drive1.E01 | MD5: 2ccfa510ee28712b01544594f4fad721 | SHA1: 2baa0524e34a684e615061829b21d6b33cd906f8
drive4.E01 | MD5: 3e81eb20ded1ae8c6ffc936d5613aacd | SHA1: e1d34bf072df9df86d864df675667ccd02c6840e
drive11.E01 | MD5: 5cc3b71463f15902b274e223642c1938 | SHA1: 40c1b3e62989b53360d3025bc1a78a12abebc902
Chapter 9
File_Signature-Examples.zip | MD5: 7b6000d2391cfedbc5d2e1ff2bd252f1 | SHA1: 34557c68b382cd1f7e82797baf075f86ff5cb350
Chapter 10
File_Analysis.zip | MD5: 2fef626ad00e7740b98d80518a18f5d1 | SHA1: 8ca90d3d03e55c5a07605faa721f9c0edb3a09b4
Photos_Examples.zip | MD5: 6fe1c8de92b5988be4b55f30fc439137 | SHA1: 70ca5111e24d5161aea0afb7f019735f952574ee
Chapter 11
Compressed_Caches.zip | MD5: 964473ea851bdc378940bbb0dbc47985 | SHA1: 3cd0f05b348c0aa7893e05280ee8fe48f6809cce
Chapter 12
e-mail_headers.zip | MD5: da9034d1a8f618be20427cd4f2251dbc | SHA1: 6c9d5b4a5b723fe2c3ba2cffe2196b9903ec587e
Chapter 13
Prefetch_Examples.zip | MD5: 720bc1d8147d61b58ae3dbb8024247e4 | SHA1: 341586e3531ce305dbd512a8ad69b6f68420e5f9
Chapter 14
Shortcuts.zip | MD5: 429fe90c28a2f39686ccb391ab8ae6f7 | SHA1: 0ca4eb9eb6f30ee6c58aef4feffe4459c4b8c25e
Shortcuts-2.zip | MD5: c1fa69ac492cbf39b3e45a31c9091b72 | SHA1: 7f3f24ecf0ddf6ff1db16c1f5dc3b6418d4de84d
JumpLists.zip | MD5: a91c14c27efd7dafd75b9b2bceb2330b | SHA1: 33513ad73690a55f8a75eda20e369cba4d9bad3e
JumpLists-2.zip | MD5: 94ec4ec4790cd0f4e999024e2b7010f0 | SHA1: aeafd47effa0f776fa984dbae5a3ce15085e55f1
Chapter 15
Thumbnails.zip | MD5:97d5a138724a70148432080c44a283d5 | SHA1: 1f28d024924c06715dfa1bf83eb59e2593b279f3
Chapter 16
LogFiles.zip | MD5: 0637cd0905ddd3cf781d95230b7e798d | SHA1: c6222c7faae516a6fa06ac16daa9dd2f4bd106c7
Chapter 17
raw_image2.dd | MD5: b85ee299a11295ec8bbec95aef7c3b11 | SHA1: 53188d28e4d8544440bc84a6a94e1b6538bdfd69
Chapter 18
timeline.zip | MD5: 577e0064ae4ed2f788a01927d0027af2 | SHA1: ec25df6c0c77d5e37f77aa35ec4c13b6b1404e20
EventLogs.zip | MD5: 68f94e1004b42f77d99358b7ed2580a1 | SHA1: 3019071944a2686f7b7c1e4a265d40da60dd6bfb
Shortcuts.zip | MD5: 429fe90c28a2f39686ccb391ab8ae6f7 | SHA1: 0ca4eb9eb6f30ee6c58aef4feffe4459c4b8c25e
Chapter 21
Note: These files have been compressed due to their sizes. Extract them from the compressed files before completing the exercises.
VeryOddNamedDocument.zip | MD5: 06401aad9da81ad7f5dd5c327fd5059d | SHA1: 7ab0ca18b9a4cc9edb15e26edc9d444cd793a96d
memory.img | MD5: 6515148944d1096cdff0fd678d85664c | SHA1: 0da63a5e6456b65f889a0e6a0ca29737d6da1a0b
memory2.img | MD5: 30c41d01b6331e66dbf5a7e0e73bfd98 | SHA1: f73009f26e9e8e8db318968ef5a81d08f181d078
memory3.vmem | MD5: a40fbc21b1957325fafd2475d524b616 | SHA1: 7e5eada2c862d7e2c686a7d8f0dba5797490374e
memory4.img | MD5: 924f31085e333558c1712bc1650974f0 | SHA1: 35ab18d968d52ab0a4e19bbc3bf7d56e8d4c8757
Chapter 22
DNS-query-response.pcapng | MD5: 12d899bb258d2ec2b8ef652b895a2e8c | SHA1: 7ba1137e0a8d5a7b29eb7bdfc9c6b9f204af77be
IntenseScan.pcapng | MD5: ca272d83359a964e4e52762072cac966 | SHA1: 95a03aba37c169fd912974146e0fa27405f7e3bd
ping.pcapng | MD5: 3c031287a8e1f0e957f177abb324d28b | SHA1: f8720a85abfcc1bcc5b709fba524b6976f1f002c
QuickScan.pcapng | MD5: 4f25c44ef2d55ab604618b519a254a48 | SHA1: 38e325f1e05493407bef13f345f1e7ef80c84937
Threeway-Handshake.pcapng | MD5: 8fe26af8ec6af3f30b7379ff85d9aa54 | SHA1: 568f1c6c0783abf982c1f01cc41ed05ef131520e
unknown.pcagng | MD5: de56cee8638d2fb55be0d3e76a497a23 | SHA1: 4cf54b1ab637401dadc12b7d55bd94d8ab97f6d8
Website-Visit.pcapng | MD5: 0fd58113e5473a8e02210f93e86a7540 | SHA1: 86df9be6662d573a380080debea1bb966dcfadf1
Chapter 23
packages.xml.zip | MD5: 8bd5f7e8d5ae4c2e0160df9cbdccc096 | SHA1: 42810a4ddce3b19e6bb37b5e4df89b9d86600740
SQLiteDB.zip | MD5: c83b35b2a5728533bb5d1fc1b6f575ba | SHA1: a933126efce76314a15c1d9195b939a52034f588
plist.zip | MD5: a113f067a8c1d449cd854d792a7d2f03 | SHA1: 5dce0ff4e912a4b7e35bed6f87c3a68dc3971b24
container.apk.zip | MD5: f012d39c04951499446b8b515e76c802 | SHA1: 464cfa5fdd4ce45be58393664ffd1ed4d56ad272