AUSCERT2024 – As We Are Many: The Spooky USB Stick

AUSCERT2024 – As We Are Many: The Spooky USB Stick

cicl

Classification

Resource Type
Training Lab or Scenario Package
Platform/OS

Technical Details

Evidence Source
  • Disk / Storage
  • Removable Media
File Format
  • RAW / DD / IMG
  • Archive / Mixed Files
Release Year
2024

Source and Access

Artifacts and Topics
  • File System
  • USB / Removable Media
Host
Contributor
  • Michael Hamm
Source Page
View Source
Primary Download
Download Dataset
Hash
SHA1: 2f9667a83abec81066d40d425397c0c0a0ae0b63
Last Verified
August 08, 2026
Topics
Digital Forensics
CIRCL forensic training package built around a specially constructed NTFS USB/disk image. The exercise covers partition tables, MBR and volume boot records, NTFS structures, raw disk manipulation, and creation and examination of a polyglot boot record. CIRCL later reused the same evidence package for its 75th TF-CSIRT DFIR training. 

Main Menu