Digital Forensic - Training Materials

Introduction

CIRCL DFIR

An introduction to file-system post-mortem forensic analysis. This page links to the materials used during forensic trainings including slides and links to the disk images.

Training Materials: Edition May 2020

Forensics Challenge ZIP

Use low level tools like ‘xxd’ and ‘dd’ to recover data out of broken ZIP archives.

cyberday.lu 2019

Download and dump the image of the USB device over your own USB stick to replay the exercises. Please take care to not accidentally overwrite your internal drive. We advice to use tools like ‘dd’ with root rights only on virtual machines or test PC’s but not on production machines. We are not responsible if you destroy your computers disk.

cyberday.lu 2020

To replay an exercise, download and flash the related USB disk image over your own USB stick. Please take care: Do not accidentally overwrite your internal drive. We advice to use tools like ‘dd’ with root rights only on virtual machines or test PC’s but not on production machines. We are not responsible if you destroy your computers disk.

Updates

  • 15th June 2018 - New training in Luxembourg
  • 16th April 2018 - Initial release of slides version 1.0
  • 29th August 2018 - Slides updated: Digital Forensics 1.0.1 and 1.0.2
  • 20th December 2018 - Slides updated: Digital Forensics 1.0.1: Winter 2018/2019 edition
  • 20th March 2019 - Slides updated: Digital Forensics 1.0.1: Edition May 2019
  • 21st March 2019 - Disk Image updated
  • 22nd May 2019 - Slides updated, Command Line Cheat Sheet v0.1 added
  • October 2019 - cyberday.lu 2019 slides added
  • November 2019 - 1.0.1 slides updates, Forensics Challenge ZIP added
  • May 2020 - Complete revamp of the training materials increase from 185 too 298 slides
  • October 2020 - cyberday.lu 2020 materials added