Help & getting started

1. Install & activate

1. Download the build for your OS from the download page: Windows, macOS or Linux.
2. Unzip it and run RedHerrings (Windows: RedHerrings.exe). It starts a local server and opens in your browser. On Windows you can run the installer instead. No admin rights needed.
3. On macOS, unzip, then Control-click (right-click) RedHerrings and choose Open the first time. If macOS still blocks it, see Gatekeeper under Troubleshooting.
4. The First Look cases run free forever with no key and no watermark. The 30-day trial, which you start with your email, adds a medium and a hard case in both forensics and incident response, up to 5 students per lab, and watermarked documents.
5. When you buy, your license key arrives by email within a minute. In the app, open Settings → Licensing, paste the key, and click Activate.

Working the cases needs forensics tools (Autopsy, Volatility, Wireshark and friends). Tools & setup has one-run install scripts and the toolkit for each certification track.

2. Generate a lab for the whole class

1. Open Case Library and pick a case. Filter by difficulty or by certification track; open a card to read the briefing and questions first.
2. Go to Generate Labs and set:
   • Students: a head count (creates student-001, student-002, …) or import a roster CSV (any common column names work).
   • Difficulty: higher difficulty injects more noise (decoy files, extra accounts, more background traffic).
   • Seed: any text. The same seed and roster reproduce the same labs, so you can regenerate a lost package or rebuild on another machine. Use a new seed each term.
   • Formats: PDF, DOCX, or both; optionally the guided worksheet.
3. Click Generate. Each lab is built, then verified: every artifact is re-opened with an independent parser to confirm the answer key is in the evidence (the green "Verified" check).

3. Hand out to students

Each student gets a LAB-<case>-<student>.zip with their own evidence, a worksheet and a hash manifest. Hand each student only their own zip. The instructor package holds the answer keys, rubrics and grading sheet; keep that one.

To use the student portal from the students' own computers, start the app from a terminal with RedHerrings run --host 0.0.0.0. It opens at this computer's network address (for example http://192.168.1.20:8420/), and the solve links you copy carry that address. Other computers get the student portal and nothing else. To open the whole app from another computer, set RH_INSTRUCTOR_TOKEN to a long random value before you start it.

4. Grade & export to your LMS

1. Collect answers, fill the grading sheet, and import it under Grading to grade the whole class at once. Tolerances: hashes case-insensitive, timestamps within seconds, text fuzzy-matched with a review flag. Every score shows why it was awarded.
2. Review the class analytics: mean, median, distribution, and the per-question correct rate that shows what tripped everyone up.
3. Export grades in Canvas, Blackboard, Moodle or D2L Brightspace format (or generic CSV), with an optional per-student feedback note listing missed questions. You can also export a case as a Common Cartridge (.imscc) module.
4. Run the anti-collusion report to see, per question, how many distinct answers were handed out and which student pairs look most alike.

Guided mode (for stuck or self-study learners)

On the Solution screen, guided mode steps a learner through one question at a time: a nudge about where to look, then how to work it with the right tool, then the answer. At generation time, the printable guided worksheet adds a hint under each question plus a tool quick-start appendix. You control whether learners may reveal solutions.

Disciplines and certification-prep tracks

The Case Library filters by discipline (Digital Forensics or Incident Response), then by difficulty and track. Digital Forensics cases group into Cert path tracks; Incident Response cases group by MITRE ATT&CK tactic. Tracks follow the published topics of popular DFIR certifications (topic alignment, not endorsement):

Digital Forensics tracks

• Foundations: entry-level fundamentals (AccessData ACE, CompTIA CySA+).
• Windows Forensics: GCFE, plus the disk domains of EnCE / ACE.
• Mobile Forensics: Cellebrite CCO/CCPA, Magnet, GASF.
• Network Forensics: GNFA.
• Cloud & SaaS: identity and cloud audit logs (GCFR).
• Linux Forensics: SANS FOR577.
• macOS Forensics: SANS FOR518.
• Advanced Forensics & IR: GCFA.

Incident Response tracks work the responder's own EDR and SIEM feeds, mapped to MITRE ATT&CK tactics and the NIST 800-61 phases, with learning pathways for Incident Handling (GCIH), SOC Analyst & Triage (CompTIA CySA+), Cloud & Enterprise IR (GCFR) and Advanced Forensics & IR (GCFA).

Pick a discipline and track to see the cases for that exam's topics. Browse the full catalog → or follow a learning pathway.

CTF mode

Run any case as a capture-the-flag: per-team flags and a CTFd import file drop it straight into a competition or class challenge.

Offline & air-gapped use

Generation and grading run on your machine with no network call. The app contacts a server only to activate, refresh or deactivate a license, and to check for updates if you turn that on. An online activation refreshes about once a month and keeps working for two weeks past that without a connection. Air-gapped machines activate offline with a request/response file and never need to refresh. No student data leaves your computer.

Troubleshooting

• Windows SmartScreen warning: builds are signed, but a new release can still trigger SmartScreen until it builds reputation. Choose More info → Run anyway, or verify the download against SHA256SUMS.txt first.
• "Error 4551: An Application Control policy has blocked this file" or "Part of this app has been blocked": that's Smart App Control, a Windows 11 feature turned on by default on new PCs. It blocks any program whose publisher Microsoft hasn't yet seen often enough, even when the file is correctly signed, and there's no Run anyway option. Open Windows Security → App & browser control → Smart App Control settings and set it to Off, then run the installer again. On many Windows 11 versions it can't be turned back on without reinstalling Windows, so this is your call; it affects nothing else about Windows Defender. The installer is signed by The Competence Collective, LLC and its hash is on the download page if you want to check it first.
• macOS: "RedHerrings can't be opened because Apple can't check it for malicious software": that's Gatekeeper. The macOS builds aren't yet notarized, so macOS warns the first time. Use whichever your version offers: Control-click (right-click) RedHerrings in Finder and choose Open, then Open again; or, on macOS Sequoia and newer, try to open it once, then go to System Settings → Privacy & Security, scroll to the blocked-app message and click Open Anyway. If neither works, open Terminal and run xattr -dr com.apple.quarantine followed by a space and the path to the unzipped RedHerrings folder, then launch it again. macOS asks only once per download. Everything is generated and graded locally, and the download's hash is on the download page if you want to verify it first.
• "All seats in use": each license activates on a set number of machines. Open Settings → Licensing on a machine you no longer use and click Deactivate to free a seat.
• Lost your key: email sales@redherrings.app and we'll resend it.
• Browser didn't open: the terminal prints a local address (for example http://127.0.0.1:PORT/); open it manually.

Still stuck?

Use the contact form. Department and Pro plans include priority support. See also the FAQ.