CIRCL forensic training image built around a USB device containing deliberately hidden data. Exercises include locating NTFS Alternate Data Streams a...
CIRCL CyberDay 2020 forensic disk exercise involving manipulated Extended Boot Records that create an abnormal chain of logical partitions. The image...
CIRCL CyberDay 2020 forensic exercise demonstrating a specially manipulated disk structure that functions as both a Master Boot Record and an NTFS Vo...
CIRCL forensic training image simulating a disk that was only partially wiped before the process was interrupted. The exercise requires manual recove...
CIRCL training exercise for examining how NTFS resident data behaves as a file grows and changes over time. The package includes an empty NTFS disk im...
CIRCL forensic training package built around a specially constructed NTFS USB/disk image. The exercise covers partition tables, MBR and volume boot re...
Hands-on CIRCL forensic training exercise focused on FAT32 file-system analysis and recovery. The lab uses a 512 MiB raw disk image to examine FAT str...
CIRCL maintains a collection of digital forensic training materials and downloadable evidence images covering file systems, disk structures, data reco...
