One case, a verified lab for every student
Pick or write a case once. Red Herrings generates, verifies, hands out, grades and exports to your LMS, all on your own machine.
Dozens of cases across two disciplines, ready to run
Digital Forensics covers disk, registry, Windows event logs, memory, network captures (PCAP), mobile, cloud, Linux and macOS evidence, with certification-prep tracks for GCFE, GASF, GNFA, GCFR and GCFA, plus Linux and macOS tracks aligned to SANS FOR577 and FOR518. Incident Response works from the responder's own EDR and SIEM feeds, mapped to MITRE ATT&CK, with tracks for GCIH and CompTIA CySA+. Filter by discipline, difficulty or track, read the briefing and questions, or build your own in the visual editor.
Your roster, your evidence, one click
Enter a head count or drop in a roster CSV, pick a difficulty (higher adds decoys and sharper distractors), choose output formats and set a seed. One click builds a differently seeded lab for every student. The same seed and roster reproduce the same labs, so you can rebuild a lost package on another machine.
Every answer key is checked against the evidence
After each lab is built, an independent parser re-opens every artifact and confirms the answer key is in the evidence. That's the green Verified check. A fact that can't be found is flagged before the lab goes out.
Each student gets only their own zip; the instructor package holds the keys and per-student notes. The built-in anti-collusion report flags shared work.
Hints when they're stuck, not the whole answer
Guided mode steps through a question one hint at a time: where to look, then how to work it with the right tool, then the answer. Print a guided worksheet with a hint under each question and a tool quick-start appendix, and decide whether learners may reveal full solutions at all.
Authentic evidence, in the formats of the job
Nothing here's a screenshot or a tidy CSV standing in for forensics. Each artifact is written in its real on-disk format, the exact bytes the tool expects, so a case opens in Autopsy, Registry Explorer, Wireshark, Volatility or DB Browser the same way a real one does. Here's what a case can hand a student, and what they open it with.
Disk images
A real FAT/exFAT volume with a live file system, directory structure and deleted entries: carve and examine it, don't only read a listing.
Windows registry
NTUSER.DAT, SYSTEM and SOFTWARE hives in the binary REGF format, carrying the keys where USB history, execution and persistence analysis live.
Windows event logs
Security.evtx and System.evtx as genuine binary EVTX: logon (4624/4625), process-creation (4688) and service events with the fields and IDs you expect, correlated by logon session.
Execution & shortcut artifacts
Prefetch written MAM/Xpress-Huffman-compressed like Windows 10/11, LNK shortcuts, and jump lists in the real CFB layout.
Memory
A Windows memory image in crash dump format that stock Volatility 3 opens: the process tree, command lines, DLLs, handles, sockets, drivers and registry hives in memory, so pslist, netscan, malfind and ldrmodules have something to find. Two Linux cases ship a LiME image with the kernel's symbol table beside it.
Network captures
A genuine packet capture with real TCP handshakes, a passive-FTP data channel, and an HTTP POST whose wire bytes and SHA-256 match the file carved from disk.
Browser history
The browser's own SQLite history database: visits, downloads and timestamps to decode and line up on a timeline.
An mbox mailbox and loose .eml messages with real headers (the Received chain, SPF and DKIM results) to trace a message back to where it came from.
Mobile: Android & iPhone
Android SMS, contacts, call-log, location-cache and messaging-app stores, and iPhone sms.db and AddressBook: real SQLite from an extraction, Apple Cocoa-time stamps and all.
Cloud audit logs
AWS CloudTrail, Microsoft 365 unified audit and Entra sign-in logs in their real JSON/CSV shapes, with the access-key and session fields that thread an attack together.
Linux & macOS hosts
Linux auth.log with PID-correlated sshd and PAM lines, web access logs, cron entries and shell history; macOS unified-log output, property lists, the TCC database and the LSQuarantine download record.
EDR & SIEM: incident response
Per-vendor EDR detections (CrowdStrike Falcon, Microsoft Defender, SentinelOne) and SIEM exports (Splunk ES, Microsoft Sentinel) in each product's real export shape, mapped to MITRE ATT&CK.
A case mixes the families its investigation needs, and a student README lists every file with its SHA-256. You pick which artifact types a lab includes when you generate it.
No class, and no LMS required
None of the class machinery is mandatory. On a Personal license, Red Herrings runs in single-user mode: one lab seeded for you, with the same evidence and verified key, and no roster, server or LMS in the loop.
Work the case in the real tools, self-check with the built-in grader and reveal the guided solution when you get stuck. Practice for GCFE, GCFA, GNFA, GCFR, GCIH, CySA+ and the vendor exams on your own schedule, and change the seed for a fresh variant any time.
See it on your own class
The First Look cases are free. A 30-day trial adds a set of sample cases, with nothing to host.