Anyone can run the First Look cases free, no account and no watermark. Open a First Look case →First Look cases · free, no account. Open one →

What's new: an account portal, certificates, and dozens more cases

Red Herrings has grown a lot since launch. Here's a round-up of what's new for instructors and self-study learners: a self-serve account portal, printable certificates, student and veteran pricing, and dozens more cases across digital forensics and incident response.

A self-serve account portal

Buyers now have a home. Sign in at account.redherrings.app with a one-time magic link (no password to set or forget) and see every license on your email, how many seats each has, and which machines they're activated on. Need to move a license to a new laptop? Release a seat yourself. Need an invoice or to change a card? The Manage billing button opens the full billing portal. Nothing to email support for.

Badges and certificates

Finishing a case now means something you can keep. Pass a case and the result screen awards achievement badges (Perfect Score, Clean Sweep, Fast Solver) and a printable Certificate of Completion. Finish a whole certification track and you earn a track certificate; top a class and the instructor can mint 1st, 2nd and 3rd place certificates straight from the leaderboard. Every certificate carries a verification code that anyone can check at redherrings.app/verify. It's proof of the work, generated entirely on your own machine.

Student and veteran pricing

The Personal plan is $69 a year for verified students and U.S. veterans, down from $129. Verification happens in your account and issues a single-use code at checkout: the same self-study library, at a price that fits a student budget.

The library keeps growing

There are now dozens of cases spanning digital forensics and incident response, from First Look warm-ups to Expert capstones, each mapped to certification tracks (GCFE, GCFA, GNFA, GCFR, GCIH, CySA+) and (for IR cases) to MITRE ATT&CK. Recent additions deepen the macOS and Linux tracks, with cases built on the TCC consent database, the quarantine record and the unified log, and an expert Linux capstone worked across five host logs. Every case still becomes a different, individually verified lab for every student.

And it's all laid out as learning pathways: ordered, case-by-case curricula that take a class from their first triage to a capstone.

Try it with your own class

The First Look cases run free with no key, and the 30-day trial needs no card: download the app, request a trial key by email, generate the sample cases and run them through grading. When you're ready, the plans start at $129 a year (or $69 for verified students and veterans).