Every student gets a different case.
Red Herrings builds realistic, randomized forensics labs from one scenario: unique evidence, a worksheet, an answer key computed from that evidence, and a rubric, for every single student. Labs cannot be copied between students or reused across semesters.
Built to be trusted, and to be sold
Realistic artifacts that open in the tools your students already use, and a verification pass that proves every answer is really there.
Real artifacts
Disk images, registry hives, EVTX logs, Prefetch, LNK and jump lists, Chrome and Firefox history, email, memory exports and mobile databases, in the real on-disk formats.
Fresh Catch verification
After generation, every artifact is re-opened with an independent parser and every answer is confirmed present. No hand-waving: if it is on the key, it is in the evidence.
One case, many variants
Names, timestamps, hashes, IPs and answers differ per student from a single seed. Same seed and roster reproduce the exact same labs on any machine.
Auto-grading
Import a student's answers and score against their variant with sensible tolerances: hashes case-insensitive, timestamps within seconds, text fuzzy-matched with a review flag.
Anti-collusion report
See, per question, how many distinct answers were handed out, and which student pairs look most alike. Copied answers stand out.
Fully white-label
One Settings screen rebrands every screen and every document: your name, logo, colors and footer. Or strip the branding entirely.
How it works
Local software. No hosting, and no runtime network call. Double-click to launch; it opens in your browser.
Choose a scenario
Five are included; build your own in the visual editor or install a pack.
Set the class
A number of students or a roster CSV, a difficulty, and a seed.
Generate
Per-student evidence, worksheet, answer key and rubric, verified as it goes.
Hand out and grade
One zip per student, an instructor package, and a built-in grader.
Five scenarios, ready to teach
Each has 8 to 15 questions across easy, medium and hard, with points and per-tool answer walkthroughs.
Insider data theft via USB
USBSTOR device history, shortcuts to a removable drive, an archiving tool, and a staged archive on disk.
Phishing to malware to C2
A spoofed email with a real Received path, a downloaded payload, persistence, and a remote-controlled process in memory.
Ransomware precursor
Tool staging, a new admin account, a persistence service, and a cleared Security log to work around.
Web shell on a server
A web shell in the web root, the worker process spawning commands, and a second-stage agent reaching out.
Employee misconduct
Browser history, searches and a data export, plus a phone extraction with incriminating messages.
Bring your own
The visual editor validates live and previews a resolved answer key. Export a pack to share or sell.
Pricing
Buy per instructor for teaching, per seat for business. A 14-day free trial, no card required.
Educator
- 25 students per lab
- Auto-grader and rubric
- Anti-collusion report
- Core pack plus one
Department
- 3 instructors, 150 students per lab
- CTF mode and scenario editor
- All packs, institution logo
- Priority support
Prices are placeholders for launch planning and are subject to change. Scenario packs are available as add-ons.
Frequently asked
Does it phone home or upload student data?
No. Generation and grading run entirely on your machine with no network call. The only time the software contacts a server is to activate, refresh or deactivate a license, when it sends just the license key, a derived machine id, the hostname and the app version. Air-gapped labs activate offline.
How do I know the answer key is correct?
After generating each lab, Red Herrings re-opens every artifact with an independent parser (The Sleuth Kit, python-registry, python-evtx and others) and confirms each answer is present in the evidence. The result is the green "Fresh Catch" checklist. Answers are computed from the generated evidence, never hard-coded.
Which tools do the artifacts work with?
The evidence is written in real on-disk formats, so it opens in Autopsy, FTK Imager, Registry Explorer, EvtxECmd, PECmd, JLECmd, Volatility-style workflows, and standard SQLite and email tools.
Can I make my own scenarios?
Yes. The visual editor validates live and previews a resolved answer key, so you can see exactly what a student will get. Export a pack to share or sell it.
Can I remove your branding?
Yes, with a white-label license. One setting rebrands every screen and document with your institution or company identity.