The Evidence Locker identifies the file as MaxPowersCDrive.E01, Windows 10 Enterprise, 29.4 GB, and attributes the 2018 Magnet User Summit CTF to Davi...
Forensic evidence from the 2023 Magnet Virtual Summit CTF, including an iOS 16 full file system, Windows 11 disk image, and Windows Server virtual mac...
Forensic evidence released for the 2026 Magnet Virtual Summit Capture the Flag. The collection includes iOS 18, Android 14, Windows 11, and macOS Sequ...
Collection of digital forensic evidence created for Magnet Forensics Capture the Flag events beginning in 2018. The datasets span computer, mobile, c...
CIRCL forensic training image built around a USB device containing deliberately hidden data. Exercises include locating NTFS Alternate Data Streams a...
CIRCL CyberDay 2020 forensic disk exercise involving manipulated Extended Boot Records that create an abnormal chain of logical partitions. The image...
CIRCL CyberDay 2020 forensic exercise demonstrating a specially manipulated disk structure that functions as both a Master Boot Record and an NTFS Vo...
CIRCL forensic training image simulating a disk that was only partially wiped before the process was interrupted. The exercise requires manual recove...
CIRCL training exercise for examining how NTFS resident data behaves as a file grows and changes over time. The package includes an empty NTFS disk im...
CIRCL forensic training package built around a specially constructed NTFS USB/disk image. The exercise covers partition tables, MBR and volume boot re...
Hands-on CIRCL forensic training exercise focused on FAT32 file-system analysis and recovery. The lab uses a 512 MiB raw disk image to examine FAT str...
CIRCL maintains a collection of digital forensic training materials and downloadable evidence images covering file systems, disk structures, data reco...
Android 7.1.2 forensic dataset from an LG Nexus 5X containing a raw mobile image, Cellebrite UFD data, cloud takeout data, documentation, and hashes f...
Android 8.1 forensic dataset from an LG Nexus 5X containing a raw mobile image, Cellebrite UFD metadata, cloud/takeout data, documentation, and hash i...
Android 9 forensic dataset from a Google Pixel 3 containing a mobile extraction, SMS/MMS data, documentation, and hash information for forensic traini...
Android 10 forensic dataset from a Google Pixel 3 containing Cellebrite and non-Cellebrite extractions, documentation, and SMS data for mobile-forens...
A Windows forensic scenario involving alleged source-code theft, requiring examination of a laptop image to reconstruct user activity and attribution...
