digital forensics:Challenge Images

digital forensics:Challenge Images

Digital Forensic Challenge Images (Datasets)

This page contains all the digital forensic challenges (datasets) I prepare either for a training course I teach, a DFIR challenge done @Security4Arabs, testing an application or written code, or just for fun! The current challenges are: Challenge #1, Challenge #2, Challenge #3, Challenge #4 and different Linux Forensic Cases. More will be added soon, so keep checking the site for updates.

Note: if you have any comments or notes, please don't hesitate to contact me, I will do my best to get back to you ASAP. Also, if you use any of my work for your training, presentation, etc, I would appreciate if you inform me. Don't worry, I won't charge you anything, and use them for free as you like. I just want to be informed for referencing purposes only.

---

• Challenge #1 - Web Server Case

A company’s web server has been breached through their website. Our team arrived just in time to take a forensic image of the running system and its memory for further analysis. All of the case files can be found here. Old upload could be found below (I'm using them as an alternative now):
1. System Image: here
2. System Memory: here
3. Hashes: here
4. Passwords = here
5. Other download URLs from (Archive.org) could be found here: here
To successfully solve this challenge, a report with answers to the tasks below is required:
1. What type of attacks has been performed on the box?
2. How many users has the attacker(s) added to the box, and how were they added?
3. What leftovers (files, tools, info, etc) did the attacker(s) leave behind? (assume our team arrived in time and the attacker(s) couldn’t clean and cover their tracks)
4. What software has been installed on the box, and were they installed by the attacker(s) or not?
5. Using memory forensics, can you identify the type of shellcode used?
6. What is the timeline analysis for all events that happened on the box?
7. What is your hypothesis for the case, and what is your approach in solving it?
8. Is there anything else you would like to add?
Bonus Question: what are the directories and files, that have been added by the attacker(s)? List all with proof.
Important Note: do not use commercial tools for your own learning benefit.


End of Case.

---

• Challenge #2 - User Policy Violation Case

This is another digital forensics image that was prepared to cover a full Windows Forensics course.
1. System Image: here
2. Hashes: here
3. Password = here
4. Other download URLs from (Archive.org) could be found here: here
You can use the image to learn the following:
1. File Carving, Custom Carving, and Keyword Searching
2. File System Forensics - NTFS
3. Deep Windows Registry Forensics: System and User Hives
• SYSTEM
• SOFTWARE
• SAM
• NTUSER.DAT
• USRCLASS.DAT
4. Other Windows Files: LNK, Jump Lists, Libraries, etc
5. Application Compatibility Cache (ShimCache)
6. Analyzing Windows Search (Search Charm)
7. Analyzing Thumb Caches
8. Analyzing Prefetch Files
9. Analyzing Recycle Bin(s)
10. USB Forensics
11. Events Analysis
12. Email Forensics: Web and Outlook
13. Browser Forensics: Internet Explorer and Google Chrome
14. Skype Forensics
This image covers most if not all of the recent system artifacts that you might encounter. Let me know if you need any help or if you are an instructor and want the answers to each part of the case. I will only send the answers to verified instructors.
Due to lots of requests, I have decided to compile a manual or a book for the second image with Q&As to help you go through the challenge and solve every part of it. URLs and further explanations will be provided very soon. Stay tuned my friends and happy hunting ;)
End of Case.

---

• Challenge #3 - Mystery Hacked System

This is another digital forensics image that was prepared to for a Windows and File System Forensics course. This is a little of a mystery, so I won't be giving out too much clues about what you can learn in this case, but I assure you, you can learn a lot ;)
1. System Image: here
2. Hashes: here
3. Password = here
4. Other download URLs from (Archive.org) could be found here: here
One day an IT dept. guy/gal came to work to find the message below written in a file on his/her system! He/Her immediately reported that to you. Now you must: 
• How was this system hacked? (What is your hypothesis)
• What evidence did you find that proves your hypothesis?
• How did you approach and solve the case? (write a report)
• Anything you would like to add?
End of Case.

---

• Challenge #4 - Launching Attacks from Alternate Data Streams

This is another digital forensics image that was prepared for to test the following:
1. Hidding EXEs in ADS
2. Running Malicious EXEs from ADS
3. Checking if Windows Defender (or other AVs), truly scan ADS
4. Hiding Malicious EXEs in Stealthy ADS
5. Showing How all of the above methods could be detected
File are below:
1. Forensic Image: here
2. Hashes: here
3. File List: here
End of Case.

---

• Linux Forensic Cases

These are four different cases to cover Linux forensic investigations and a brief could be found below:
1. Case1: Compromised Web Server
2. Case2: Compromised Hadoop (HDFS) Cluster
3. Case3: Attacker's Kali Linux System
4. Case4: Investigating/Hunting Hidden Processes
All case files could be found here
End of Summary.

ที่มา:

https://www.ashemery.com/dfir.html

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud #ฝึกทำLab