DFIR Training Blog



The best forensic test image ever!

The best forensic test image is the image that you personally create, and this is probably not the answer you want to hear because you know just how long it will take to create an image from scratch.  I'm not talking about imaging your personal machine, but rather, building an entirely new system from scratch, filling it full of data and user activity, and subsequently creating a forensic image of it. Lots of effort. Lots of time. But you get the perfect test image. There are few things you can do to minimize your time and maximize the effectiveness of creating your own test images, as well as other options of using test images.

First, let's talk about alternatives to building your own forensic test images.

3rd party images

A reminder that you can find terabytes of test images and data at https://www.dfir.training/resources/downloads/ctf-forensic-test-images.

The images are organized as CTFs, malware, registry samples, Windows event samples, and everything else (email data sets, data sets by file types, various OS images, mobile images, drone images, etc...). If you are looking for a 3rd party image, there is bound to be something here that you can use to fit your needs. You can also find test images in some DF/IR textbooks as part of the lesson plans in the textbooks. Some software vendors also provide test images to download from their websites or part of their training courses.

Basically, there is quite the number of datasets and images at your disposal. However, there are drawbacks to 3rd party images to be aware.

---The data may or may not be what you need to test
---You have to trust the 3rd party created the images correctly (as they stated with data/user activity)
---This can work if the image was created by the 3rd party to fit your needs
-CTF images created by 3rd parties are good for testing your skills
---The answers are available, so it is test of your skills (a contest)
---Still may not be exactly what you need to test a specific software/skill
-Random storage media (ie, used hard drives) contain unknown data and unknown user activity
---Unreliable as a test of your tools or skills when you don't know what the answers should be
---At best, it is entertaining to see what you can find
---At worst, you may find/possess data that you don't want to possess
-Self-created test images are trusted
---Created for specific tests using known data and known user activity
---Known data/known user activity is the best test of skills/software

Written by :Brett Shavers

{rscomments option="com_rsblog" id="72"}