Anyone can run the First Look cases free, no account and no watermark. Open a First Look case →First Look cases · free, no account. Open one →

Download Red Herrings

The desktop app runs entirely on your machine. Every First Look case runs free with no key or account. For the rest, request a 30-day trial key by email: it adds a medium and a hard case in each discipline, the student portal and grading for up to five students.

v1.16.0
Windows

Windows 10 or 11, 64-bit. Run the installer; it adds a Start menu entry, needs no admin rights, and upgrades in place. The app opens in your browser.

Download the installer · 41 MB
SHA-25647ff2979641ce907f549161928e120368850ce8938a8b541c907fb74c048b41e

Prefer no install? Portable zip · 53 MB: unzip anywhere and run RedHerrings.exe.

Verify the download

In PowerShell, in the folder you downloaded to:

(Get-FileHash .\RedHerrings-Setup-1.16.0.exe -Algorithm SHA256).Hash

The output must match the SHA-256 above (letter case doesn't matter). The portable zip's checksum is 8f1e125a4277b9bd61aa77b02cbe9d6cf0d50302f084850f0dfa3030544dbec8.

✓ Installer and app are Authenticode-signed by The Competence Collective, LLC. Windows shows the publisher name on the run prompt.

Blocked with "Error 4551" or "Part of this app has been blocked"? That's Windows 11 Smart App Control, which blocks newer publishers even when signed. How to get past it.

macOS

macOS 12 or newer. Pick the build for your Mac (Apple menu → About This Mac shows the chip). Unzip, then double-click RedHerrings; it opens Terminal and your browser.

SHA-2568bfc9aa49051a302b06475b647ed49e78fab330bd6e889012dc6bb06e07ba8eb
SHA-256f8c9d5f8a916ccb79055fbad024db67721b7172450862b53bfc40832cf0b8be3
Verify the download

In Terminal, in the folder you downloaded to:

shasum -a 256 RedHerrings-macos-*.zip

The output must match the SHA-256 above.

Not yet notarized, so macOS warns on first launch. Control-click RedHerrings and choose Open, then Open again. Still blocked on a newer Mac?

Linux

64-bit Linux with glibc 2.35 or newer (Ubuntu 22.04 and SIFT, Debian 12, Fedora 36 or newer). Unzip and run ./RedHerrings.

Download for Linux · 80 MB
SHA-256e16affc7d655fe9fc9f54bb156baba4f45092c8ac6dd09a138f2db6dbd7762f6
Verify the download

In the folder you downloaded to:

curl -LO https://github.com/Steve-is-IT/redherrings-site/releases/latest/download/SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt --ignore-missing

It should print RedHerrings-linux.zip: OK.

Start your 30-day trialFirst Look is free for everyone. The trial adds a medium and a hard case in both forensics and incident response, plus the student portal, timed exams and analytics, for up to five students. Enter your email and we'll send a key, no card. Tell us how you'll use it and we'll tailor the guide that comes with it.
Runs locallyGeneration and grading never leave your machine. The only network calls are license activation and an update check you opt into. Trust & security
VerifiableEvery release ships SHA256SUMS.txt. Certificates students earn can be checked at verify.
Then activateBuy a plan and paste the emailed key under Settings → Licensing. Air-gapped machines activate offline. See plans
Installing on a managed machine? Your IT team can allow it by publisher (an AppLocker, WDAC or Intune publisher rule for The Competence Collective, LLC covers every release) or by the SHA-256 above. The app needs no admin rights (the installer is per-user, and the portable zip unzips to a folder) and listens only on this computer unless you start it for a class with --host 0.0.0.0; then other computers reach the student portal and nothing else. Full details on the Trust & security page.