Downloads consist of DFIR Training hosted files and links to sources of downloads.

Forms

 Rather than recreate DFIR forms from scratch, these examples will be helpful in designing your internal forms.

Policies

 REAL policies that are in use today by government agencies regarding digital forensics and electronic evidence. These are great as resources to design your internal policy (private or public sector).

Search Warrants

A collection of REAL search warrant affidavits and complaints. Not templates, but actual affidavits that can be used as reference, source material, and inspiration for your own work.

Infographics & Cheat Sheets

Useful as helpful reminders for your work, or as source material to create your own infographics for case presentations.

Reports

Samples of REAL reports, useful as general guides and to review what has been done in past cases.

Guides

General and detailed guides revolving around electronic evidence, perfect for helping create internal guides and procedures for your organization.

White Papers

Links to thousands of DFIR white papers! If you need a DFIR white paper, it exists in one of these sources. Seriously. Thousands of white papers!

Keyword Lists

REAL keyword lists that have been used in REAL cases. Download and tailor the lists to suit your needs in your analysis and keyword searches.

Ultimate Windows Registry Cheat Sheet

 Perhaps the most comprehensive Windows registry cheat sheet you will ever find, with new keys being added regularly.

CTFs

One of the common questions on the Internet: "Where can I find CTFs?".  Here is one answer! An ever-growing and ever-changing list of CTFs!

Forensic Images

Another of the most common questions asked on the Internet, "Where can I find forensic test images?" Again, one answer is here!

Malware

Beware when downloading malware because the malware is REAL, actual samples!

Registry Samples

Rarely can you find registry samples online, but here is a good start for you!

Windows Event Samples

Another start of samples when you want to test against Windows event samples.