🧮 Digital Forensics Lab Work

This repository contains a collection of hands-on digital forensics labs focused on Linux, Windows, mobile, and network environments. The labs emphasize practical techniques used in real-world investigations such as timeline reconstruction, artifact recovery, user activity correlation, and memory analysis.

📄 Contents

• Download Lab Compilation (PDF)

📚 Table of Contents

1. Applying the Daubert Standard to Forensic Evidence
   Examines the admissibility of forensic techniques using legal standards for scientific reliability.

2. Recognizing the Use of Steganography in Image and Audio Files
   Identifies and analyzes hidden data embedded in multimedia files.

3. Recovering Deleted and Damaged Files
   Demonstrates data recovery through file carving and hex-level analysis.

4. Conducting an Incident Response Investigation
   Documents key steps in live response and post-breach evidence collection.

5. Forensic Investigations on Windows Systems
   Investigates Windows-specific artifacts like registry keys, logs, and application usage traces.

6. Forensic Investigations on Linux Systems
   Analyzes bash history, system logs, cron jobs, and shell artifact correlation.

7. Email and Chat Log Analysis
   Examines metadata, headers, and message content for signs of tampering or exfiltration.

8. Mobile Device Forensics
   Focuses on device acquisition, application artifact recovery, and location data interpretation.

9. Network Infrastructure Forensics
   Analyzes router, firewall, and DHCP logs to identify compromise patterns and unauthorized access.

10. System Memory Forensics
    Extracts volatile data, running processes, injected code, and registry fragments from live memory.

🛠 Tools & Techniques Used

• SleuthKit (fls, istat, mactime)
• auditd and ausearch
• Memory analysis utilities
• File carving tools and hex editors
• Linux and Windows command-line forensics
• Timeline reconstruction and user behavior profiling

👤 Author

Michael Twining
Cybersecurity Researcher | Digital Forensics & Incident Response | GitHub: @usrtem
📫 michael.twining@outlook.com
🌐 LinkedIn | YouTube

🔐 License

This project is licensed under the Creative Commons Attribution 4.0 International License.