Investigate real evidence, and build the DFIR skills to show for it.
Every case hands you real artifacts to examine, from disk and memory images to network captures, mobile and cloud evidence and live EDR and SIEM feeds. They come in the formats you meet on the job and open in the tools analysts actually use, like Autopsy, Volatility and Wireshark. The cases run from a single-artifact first look to a multi-hour intrusion, so they suit a working professional sharpening their skills and someone still learning the craft.
The First Look cases are free, no account and no watermark. Download for Windows, macOS or Linux and work a real case end to end, fully offline. When you're ready for a class, a 30-day trial adds sample cases from the paid library, the student portal, timed exams and whole-class grading.
What makes it different
Built for everyone who trains on real evidence
The same engine serves a first-year class and a corporate SOC. Pick the path that fits.
Instructors & programs
A different graded lab for every student, two ready-made course syllabi, cert-prep pathways, and grades that post to Canvas, Blackboard, Moodle or D2L.
From $499 a year → Security teamsSOC, IR & blue teams
Train analysts on timed drills, CTFs and exams with integrity logging, each one graded against that analyst's own evidence. Commercial use, on your network.
Train your team → Training providersTraining companies & MSSPs
White-label the whole platform, author your own cases in the editor, and resell them as packs. One Pro license, unlimited participants.
White-label & resell → Government & defenseEnterprise & agencies
Unlimited seats at one site, an on-premises license server and air-gapped activation, with an SLA and procurement paperwork. Nothing leaves your environment.
Talk to us about Enterprise → Self-learnersCertification candidates
Practice for GCFE, GCFA, GCIH or CySA+ on your own. Generate a case for yourself, work it in your own tools, check your answers with the built-in grader, and step through the full solution when you're done.
From $129 a year → Try it firstFree to start
The First Look cases, in forensics and incident response, are free forever, no account and no watermark. A 30-day trial adds a set of sample cases from the paid library, the student portal, timed exams and class analytics. No card.
Learn for free →A cyber range gives everyone one shared lab. This gives each person their own.
Building realistic evidence by hand takes a senior specialist days per case, and a cyber range rents you one shared lab in its cloud. Red Herrings generates a different case for everyone, runs on your own machine, and grades it for you.
- One shared environment, the same for everyone
- Hosted in the vendor's cloud, so you rent seats by the month
- Answers and write-ups circulate within a term
- Priced per student because the vendor pays for the compute
- Needs the internet; nothing works in an air-gapped room
- A different case for every learner, generated fresh
- Runs on the learner's own laptop, nothing to host
- Collusion fails by design: a classmate's answer is the wrong answer
- One flat price, well under per-seat range pricing
- Works fully offline, even in an air-gapped classroom
One authored case becomes a hundred unique, auto-graded labs, and every extra person costs nothing to add. No other training tool can say the same.
Real evidence, and an answer key checked against it
These aren't multiple-choice quizzes dressed up as forensics. The artifacts come in the real formats of the job, and the answer key is checked against them before anyone sees it.
Real evidence, in the formats they'll meet on the job
- Digital forensics: disk images, registry hives, Windows event logs, Windows and Linux memory images, PCAPs, Prefetch, LNK and jump lists, browser history, email, cloud audit logs and mobile databases, all in genuine on-disk formats.
- Incident response: EDR detection feeds, SIEM alert exports, packet captures and host event logs, mapped to MITRE ATT&CK and tagged with the NIST 800-61 phases, so students respond the way a responder does.
- Opens in the tools of the trade: Autopsy, FTK Imager, Registry Explorer, EvtxECmd, Wireshark, Volatility 3 and standard SQLite and email tools.
A different investigation for everyone
- Names, timestamps, hashes, IPs and answers all change from one seed, so a copied answer is the wrong answer.
- Catch collusion, not only cheating: a per-question report flags which submissions look most alike.
The key is checked against the files
- Every answer is computed from the generated evidence, never hard-coded, then confirmed present in each file by an independent parser before release. This is the verification check.
Grading that shows its work
- Auto-grading with sensible tolerances: hashes ignore case, timestamps allow a few seconds, free text is fuzzy-matched and flagged for review. Every score shows why, and one click overrides it.
- Grade the whole class at once, see per-question correct rates, and export to Canvas, Blackboard, Moodle or D2L, or post over LTI 1.3.
- Students can solve in the browser: a private link per student, practice or timed exam, with the answer key never reaching the page.
Built for how forensics is actually taught
- A learning on-ramp: guided mode walks a stuck learner from where to look, to how to work it, to the answer, one question at a time. Or run any case as a capture-the-flag.
- Investigation report and chain of custody: a court-ready template with the evidence manifest and hashes already filled in, which is the part employers hire for and most courses skip.
- Certification-prep and ATT&CK tracks: filter forensics cases by cert path (GCFE, GCFA, GNFA, GCFR, EnCE, Cellebrite, Magnet) and incident-response cases by MITRE ATT&CK tactic, or follow a learning pathway from first look to capstone.
Grades post straight into your LMS
Trademarks are the property of their respective owners and are shown to indicate compatibility, not endorsement.
From zero to a graded class in four steps
It's desktop software: double-click to launch and it opens in your browser, even on a machine with no network at all.
Pick a case
Choose from the library, write your own in the visual editor, or install a pack.
Set the class
Give it a head count or a roster CSV, a difficulty and a seed. That's the whole setup.
Generate
It builds the evidence, worksheet, answer key and rubric for each student, verifying every one as it goes.
Hand out and grade
Hand each student a zip or a private portal link, then batch-grade and post the results to your LMS.
From one log file to a multi-hour capstone
Dozens of verified digital forensics and incident response cases. Pick how many questions each student gets. Every answer comes with a per-tool walkthrough.
First Look: USB Device History
Registry hives and a shortcut file. Work out which USB drive was plugged into the machine, when, and what was opened from it. Free, no key.
First Look · IRFirst Look: Reading an EDR Alert
Your first shift on the SOC queue. One endpoint threw a short stack of EDR detections: triage by severity, read the process tree and the ATT&CK technique, and call it real or noise. Free, no key.
MediumInsider Data Theft via USB
An engineer who has resigned is suspected of walking out with confidential files on a USB stick. Prove what was connected, what was copied, and when. Opens with the trial key.
Hard · IRRansomware Before Coffee
You're the on-call responder. The EDR console lit up at 06:48 with a stack of detections from a finance workstation. Triage the feed and the host's event logs, scope the intrusion, pull the indicators, map it to ATT&CK and make the containment call.
HardPlacing the Phone at the Scene
An Android extraction with location history and a seized laptop's browser history. Work out where the phone was the night a warehouse was hit and what was sent from it. Mobile forensics for GASF and Cellebrite prep.
Expert · IROperation Nightfall
The incident-response capstone. Overnight, ransom notes appeared across a hospital. Work the SIEM, the EDR feed and the host logs through every NIST 800-61 phase, then write the incident report.
The First Look cases are free for everyone. Every paid plan adds the Medium and Hard cases; Department, Team, Pro and Enterprise add the Expert and Marquee capstones and the Scenario Editor.
Download, start the trial, teach
It's a desktop app for Windows, macOS and Linux, with no account to create. The First Look cases run free with no key. Start the 30-day trial with your email to open a set of sample cases from the paid library.
Current version v1.16.0 · Checksums & system requirements · Free tools & setup · Lost your key?
Pricing, per instructor or per seat
The First Look cases are free forever, no account or card. A free 30-day trial adds a set of sample cases, and every paid plan includes both disciplines, the auto-grader and unlimited lab generation.
Trial
Try it with a real class
- First Look cases free forever, no account or watermark
- Sample cases from easy to hard in both forensics and incident response
- Up to 5 students per lab
- Student portal, timed exams & class analytics
- Watermarked documents. Need longer than 30 days? Ask.
Educator
One instructor, up to 40 students per lab. About $12 a student for a full class.
- 40 students per lab
- Auto-grader, rubric and LMS export
- Anti-collusion report
- All forensics and IR cases except Expert capstones
- Student portal, timed exams and LMS passback
Department
Programs with several instructors
- 3 instructors, 150 students per lab
- CTF mode and Scenario Editor
- Every case including Expert capstones
- Institution logo on documents
- Priority support
Prices in USD. Scenario packs are available as add-ons. Institutional purchase orders welcome.
Frequently asked questions
Does it phone home or upload student data?
No. Generation and grading run entirely on your machine with no network call. The software contacts a server only to activate, refresh or deactivate a license, when it sends only the license key, a derived machine id, the hostname and the app version, and to check GitHub for a new version if you turn that on. Air-gapped labs activate offline.
How do I know the answer key is correct?
After generating each lab, Red Herrings re-opens every artifact with an independent parser (The Sleuth Kit, python-registry, python-evtx, LnkParse3, dpkt and others) and confirms each answer is present in the evidence. The result is the green Verified checklist. Answers are computed from the generated evidence, never hard-coded.
Which forensic tools do the artifacts work with?
The evidence is written in real on-disk formats, so it opens in Autopsy, FTK Imager, Registry Explorer, EvtxECmd, PECmd, JLECmd, Wireshark, Volatility 3, and standard SQLite and email tools.
Can I get grades into Canvas, Blackboard, Moodle or D2L?
Yes. Grade the whole class in Red Herrings, then export a grade file in Canvas, Blackboard, Moodle or D2L Brightspace format, with an optional per-student feedback note listing what each learner missed. You can also export a case as a Common Cartridge (.imscc) content module that imports into any conformant LMS.
Is there anything to help beginners learn?
Yes. Guided mode on the Solution screen steps a learner from a nudge about where to look, to how to work the question with the right tool, to the answer, one question at a time, instead of showing everything at once. An optional guided worksheet prints a short hint under each question and a tool quick-start appendix, so students can start away from the app.
Does it cover incident response, or only forensics?
Both. Digital forensics cases cover disk, registry, event logs, memory, network, mobile and cloud evidence. Incident response cases are worked from EDR detection feeds and SIEM exports, mapped to MITRE ATT&CK and tagged with the NIST 800-61 phases. Every plan includes both.
Do students need to install anything?
No. Hand each student a zip to work in their own tools, or a private link to the student portal, where they read the evidence and answer in the browser. Grading runs on your machine either way.
Can I write my own scenarios?
Yes. The visual editor validates live and previews a resolved answer key, so you see exactly what a student will get. Export a pack to share or sell it.
Can I remove the Red Herrings branding?
Yes, with a white-label license. One setting rebrands every screen and document with your institution or company identity.
Stop building forensics labs by hand.
A fresh, verified case to investigate, with an answer key proven against the evidence.