How Red Herrings compares to the other ways to run a forensics lab
Most programs run labs one of three ways: an instructor builds the evidence by hand, the class works a public challenge image, or the school buys seats on a hosted range. Each works. Here's what each costs you in time, grading and integrity, next to what Red Herrings does.
A different case per student · keys proven in the evidence · graded on your machine · exports to any LMS
Side by side, honestly
We built Red Herrings after years of doing the first column by hand. The other approaches have real strengths, and the table says so.
Swipe the table to compare all five approaches →
| What matters | Build your own evidence | Public challenge images | Hosted cyber ranges | Red Herrings |
|---|---|---|---|---|
| Time to a new lab | Days to weeks per case: stage a VM, plant artifacts, image it, write the key, check the key. | Minutes to download. Hours to write questions and a key the image actually supports. | Minutes, from the vendor's catalog. | Under five minutes: pick a case, set the class size, generate. |
| A different case for every student | Only if you build every variant. Nobody does. | No. One image, one answer set, and the write-ups are a search away. | Rarely. Shared scenarios, sometimes with a shared answer. | Yes. Names, timestamps, hashes, IPs and answers change per student from one seed, so copying produces a wrong answer. |
| Answer key checked against the evidence | By you, by hand, every time you change anything. | Depends on the author. Errata live in forum threads. | Vendor's responsibility; you can't see the check. | Every artifact is re-opened with an independent parser and every answer confirmed present before the lab ships. The result is shown to you. |
| Grading | Manual, against the key you wrote. | Manual. | Usually built in, inside the vendor's portal. | One click, with tolerances for hashes, timestamps and free text, every score explained, and close calls flagged for your review. |
| LMS and gradebook | Type scores in yourself. | Type scores in yourself. | Sometimes LTI, often a separate login for students. | CSV for Canvas, Blackboard, Moodle and D2L; LTI 1.3 with grade passback; Common Cartridge and QTI export. |
| Where student data lives | On your machine. | On your machine. | On the vendor's servers, under their terms. | On your machine. The app runs offline; no roster, submission or grade leaves it. |
| Tools students use | The real ones: Autopsy, FTK Imager, Registry Explorer, Volatility 3, Wireshark. | The real ones. | Often a browser terminal or a remote desktop inside the range. | The real ones, on the student's own machine, from a zip. Optional browser portal for answers only. |
| Evidence realism | As real as you make it, if you have the time. | Often excellent, sometimes dated, always already solved online. | Varies by vendor. | Real formats: disk images, registry hives, EVTX, Windows and Linux memory images, PCAPs, SQLite, email and cloud audit logs, each generated to open in the standard tool for it. |
| Certification alignment | Your mapping. | None, or informal. | Sometimes, for the vendor's own certs. | Cases tagged to GIAC, CompTIA, EnCE and Cellebrite objectives and to MITRE ATT&CK, with a coverage map and pathways per track. |
| Syllabus and course design | Yours to write. | Yours to write. | Sometimes a vendor curriculum. | A 14-week forensics course and an 8-week incident response course, with syllabus PDFs and one-click generation of every week's lab. |
| Cost for a 40-student class | Free in dollars. Weeks of instructor time per case. | Free. Instructor time for questions, keys and grading. | Typically priced per seat per year, so it scales with enrollment. | One Educator license covers the instructor and 40 students per lab. Pricing is on the home page. |
| Best when | You need one very specific scenario and have the time to craft it. | Self-study, clubs and CTF practice where sharing solutions is fine. | You need live attack infrastructure, red-team exercises or a hosted classroom. | You teach forensics or incident response to a class and need labs that are graded, defensible and different for every student. |
Columns describe typical experience with each approach, not any single product. Trademarks belong to their owners and indicate compatibility, not endorsement.
Where the other approaches still win
There are three things Red Herrings doesn't try to do, so you can plan around them.
Live adversaries and attack infrastructure
Red Herrings produces evidence to investigate, not a network to defend in real time. For red-versus-blue exercises with live tooling, a hosted range is the right tool. Many programs run both: the range for the exercise, Red Herrings for the graded investigation afterwards.
A specific real-world case
If your course is built around one famous incident or one specific malware family, a hand-built image or a published challenge will match it more closely. The Scenario Editor lets you author your own case in Red Herrings, but it's still a generated case rather than a recreation.
Open community practice
Public challenge images come with write-ups, forums and a community working the same files. That's a feature for self-study and a problem for a graded assignment. Red Herrings is for the graded assignment.
Questions evaluators usually ask next
Short answers here, longer ones on the linked pages.
Can I see a generated lab before I buy?
Yes. The sample lab is a full student zip of real evidence, and two cases run in the browser with nothing to install. The First Look cases are free forever with no account, and a free 30-day trial adds a set of paid sample cases, for up to five students, with watermarked documents.
What if the evidence doesn't open in my tool?
Every artifact is written in the real on-disk format and re-opened with an independent parser as part of generation. The tool setup page lists the tools each track uses. If something doesn't open, tell us and we fix the generator, not the case.
How does grading handle partial credit and judgment calls?
Hashes and timestamps have tolerances, free-text answers use fuzzy matching with a threshold you control, and every score comes with the reason. Answers close to the threshold are flagged for your review, and a report rubric covers the written part of an assignment.
Does my institution need to sign anything or host anything?
No. The app runs on the instructor's machine. There's no server to stand up and no student account to create. Purchase orders are welcome, and the trust page has the data-flow description security reviewers ask for. A one-page evaluation guide for departments is there to forward to a chair or purchasing office.
What happens when the license ends?
Labs you already generated, and the grades you recorded, stay on your machine and keep working. The app stops generating paid cases until a key is active again; the First Look cases stay free.
See it with your own roster
Download, open it, and generate a three-student lab in under five minutes. No account or card required.