Free resources for teaching forensics and incident response
Forms, checklists, rubrics and syllabi you can hand to a class tomorrow. All PDFs, no sign-up, free to copy and adapt for classroom use. Most of them pair with something the app does, and all of them work without it.
Guides by role
Where to start, depending on who you're training. Each one lists the cases in order, with what runs free, what the trial opens and what needs a license.
Teach a DFIR lab course
A 14-week forensics term and an 8-week IR course with each case's cert topic, how grading works, and grade import steps for Canvas, Blackboard, Moodle and D2L.
Read the guide Guide · security teamsRun scored IR drills
A drill plan from First Look triage to a full intrusion, the ATT&CK techniques it exercises, and how to run a timed exercise with integrity logging.
Read the guide Guide · self-studyLearn DFIR around a job
Two study paths from First Look to a capstone, the free tools each week needs, and a plan of about three hours a week.
Read the guideForms and checklists
These are the forms that turn a lab exercise into an investigation. Print them, or drop them into your LMS as assignment attachments.
Evidence chain of custody
Case and item fields, an acquisition block with hashes, an eight-row custody log and a final disposition section. A teaching note explains how to use the generated evidence manifest with it.
Download PDF Checklist · 1 pageWhat a defensible forensic report contains
Eight sections, in the order a reader needs them, with a checkbox for each thing that has to be present. It ends with the ways student reports usually lose marks.
Download PDF Rubric · 1 pageInvestigation report rubric
A 100-point rubric with six criteria and four levels, a scoring guide, and a note on how per-student evidence changes the collusion conversation.
Download PDFSyllabi and course design
Two complete courses with outcomes, grading, tools and a week-by-week plan. Use them as they are or as a starting point for your own.
Introduction to Digital Forensics
Windows artifacts, disk, memory, network and mobile across a semester, with a graded lab each week and a capstone investigation.
Download PDF Syllabus · 8 weeksIncident Response Fundamentals
EDR and SIEM triage, the NIST 800-61 phases, ATT&CK mapping and two timed drills, ending in a timed ransomware incident with a breach report.
Download PDF CLARK template · WordIntroduction to Digital Forensics (CLARK format)
The same 14-week course laid out in the CLARK Cybersecurity Curriculum Template: module-by-module schedule, grading table, free readings and a curriculum alignment table. Ready to upload or adapt.
Download DOCX CLARK template · WordIncident Response Fundamentals (CLARK format)
The 8-week course in the CLARK template, with the two timed drills, the final incident, the breach report rubric and policies written to be used as they are.
Download DOCX In the appGenerate every week's lab in one click
Both courses ship inside Red Herrings as course packs. Set a class size once and the app generates and verifies a semester of labs.
See course packsEvaluate and reference
These are for the people who decide, and for the people who want to see the evidence first.
Evaluation guide for departments
What the software does, what to check in the trial, how a purchase works and the security and procurement answers, on one page to forward to a chair or purchasing office.
Download PDF Sample labA complete student lab
A Windows disk image with registry hives, event logs, Prefetch and LNK artifacts, a hash manifest and the worksheet.
Open the sample ReferenceMITRE ATT&CK coverage map
Every technique the case library exercises, by tactic, with the cases that teach each one. Useful for mapping a course to the framework.
Open the mapWant the labs to go with them?
Dozens of verified cases, a different variant for every student, graded on your machine. Free First Look cases, no account, plus a 30-day trial with sample cases to try.