Download a free sample forensic lab
Real evidence, not a screenshot. One complete case, a Windows insider-threat USB exfiltration, with the raw artifacts and a student worksheet. Work the questions in the tools you already teach with. No account, no install, no email.
The disk image expands to 64 MB. Everything is synthetic: no real personal data, safe to open on any machine.
What's in the ZIP
This is a slice of a Windows workstation in real on-disk formats, laid out the way an examiner would pull it.
A raw disk image
evidence.dd: a raw image to mount, load into Autopsy or FTK Imager, and carve.
Registry hives
NTUSER.DAT, SYSTEM and SOFTWARE: USB device history, user activity and system configuration, for Registry Explorer or RegRipper.
Windows event logs
Security.evtx and System.evtx in native binary EVTX, for EvtxECmd, Event Viewer or your SIEM pipeline.
Execution and file-access artifacts
Prefetch files, LNK shortcuts and a jump list: what ran on the machine and what was opened.
A filesystem timeline
An $MFT timeline CSV plus a full HASH-MANIFEST so you can verify every artifact is intact.
Worksheet
A student worksheet (PDF and DOCX) with the briefing and questions. The answer key isn't in the ZIP. It stays in the instructor package, and each student's lab is graded against its own key.
Open it in the tools you already use
It opens in the standard DFIR toolset, with nothing proprietary to learn:
New to a tool? The Tools & setup page lists where to get each one, and the blog walks through the techniques this case uses.
The catch: every student gets a different one
This download is student 001. In a class, every student gets a different version of the same case: their own device serial, user, file names, timestamps and answers, so a copied answer is the wrong answer. Each lab is re-solved against its own evidence before release, so the key is correct for that student. Hand out one lab per learner and grade the class at once.