A grant-funded, openly published collection of interactive digital forensics labs, case studies, and STIX-structured forensic intelligence datasets built for students, faculty, and authorized practitioners training on Kali Linux.

frankwxu/digital-forensics-lab is not a single executable tool but a curated training corpus: an open repository of interactive labs, slide decks, evidence files, case studies, and structured forensic intelligence datasets, all aimed at teaching digital forensics through practice rather than lecture. The repository carries roughly 2,900 stars, is written primarily in Jupyter Notebook, and is maintained by an academic team supported by grants from the DOJ, DHS, and NSF — a funding pedigree that explains both the breadth of the curriculum and its commitment to regular updates. For professionals who mentor junior examiners or design internal training programs, this is one of the more complete freely available curricula in the field.

The README is unusually well organized, functioning as a full table of contents across several tracks. It begins with foundational computer skills — number systems, PC architecture, Windows and Linux command-line tutorials, including an advanced Linux module — then escalates into core forensic technique: a Sleuth Kit tutorial, USB image acquisition, evidence search as a pattern-matching exercise, file metadata analysis, data carving, steganography, and even a formal Forensic_Report_Template.pdf. The progression is deliberately pedagogical, assuming no prior forensic background while still arriving at examiner-grade workflows.

A networking forensics track, added in March 2023, leans on the Python Scapy and NetfilterQueue libraries. Labs cover HTTP analysis in Wireshark for both text and image evidence, SYN flood investigation with TShark, SMTP email forensics, ARP poisoning forensics, firewall log analysis, DNS fundamentals, DNS spoofing forensics, and WEP40 wireless investigation with Aircrack. This is where the curriculum doubles as incident-response training: every offensive technique is presented from the investigator's side, teaching students what these events look like in packet captures and how to reconstruct them evidentially.

The case-study section is the heart of the repository. Seven computer-forensics scenarios include the NIST data leakage case — a large, deliberately complex intellectual-property-theft scenario distributed as DD/EnCase images from the NIST CFReDs archive, with fourteen hands-on labs covering registry analysis, Windows event logs and XML, web history and SQL, email plus USB correlation, and USN journal file-change history. Several of these labs come in both command-line and Python versions, a thoughtful duplication that lets instructors choose between tool-driven and script-driven pedagogy. Additional cases cover P2P data leakage on Windows 10, email harassment, memory forensics for an illegal file transfer, a hacking investigation, and a Morris Worm attack reconstruction updated in January 2023.

Mobile and IoT forensics get their own track, which is where the repository shows its maintenance discipline: Android 10, iPhone iOS 13, a DJI drone, Echo Show 8 (added December 2023), and an Eufy doorbell investigation (October 2024) — the latest noted addition. Covering consumer IoT endpoints is a genuine differentiator, since most open curricula stop at phones, while real casework increasingly involves doorbells, smart displays, and drones as evidence sources.

What the README calls the Forensic Intelligence Repository may be the most operationally interesting artifact for working analysts: two structured forensic-intelligence datasets in JSON format, derived from real case studies — one on email harassment, one on illegal possession of images — stored under STIX_for_digital_forensics. Encoding case-derived indicators in STIX bridges the gap between one-off examinatorial findings and shareable, machine-readable threat intelligence, and it teaches students to think of forensic output as structured data rather than prose reports. That framing alone makes the datasets worth studying for teams building intelligence pipelines.

A newer AI4Forensics section extends the curriculum into machine-assisted examination. It includes a CIKM 2024 tutorial session with a hands-on lab, a fine-tuned model for identifying IP addresses, suspect profiling from browser history using LLMs via browser_analysis.ipynb and a Colab-ready variant, and political-insight analysis over email corpora. There is also a companion module built on Cellebrite's 2022 CTF competition dataset, covering three device extractions — Beth's iPhone, Heisenberg's Android phone, and Marsha's iPhone — with lab-instruction PDFs available to faculty on request. The Jupyter Notebook language classification of the repo reflects this analytical layer.

Environment setup is handled three ways, all sandbox-friendly. Method one imports a customized Kali Linux 2021.4 OVA into VirtualBox with tools preinstalled. Method two installs Kali manually and runs a setup script, e.g. wget the tool-install-zsh.sh from the repo, chmod +x, and execute it — tested on Kali 2021.4, with an 80 GB virtual disk recommended since individual case images can exceed 30 GB. Method three, added September 2023, builds a Docker container on Ubuntu 22.04 LTS with all tools preinstalled, documented in a dedicated Docker_4_Digital_Forensics.pptx tutorial. All tools used across the curriculum are free and open source, which keeps the entire program costless to replicate.

Two contextual notes from the README deserve attention. First, the repository now anchors a 649-page second edition of a beginner's textbook, with a separate companion materials repo containing chapter-aligned presentations, downloadable evidence files, and a Windows command-line tutorial; faculty can request a complimentary desk copy via institutional email. Second, the license field reads NOASSERTION, meaning the repository itself lacks a clear open-source license — a real consideration before redistributing or adapting the slides inside an enterprise training program. Reuse for internal instruction is almost certainly within the authors' intent, given their explicit invitation for feedback and collaboration, but formal licensing is absent.

For authorized professionals, the value here is threefold: a ready-made curriculum for mentoring, a source of realistic practice evidence from NIST and CTF datasets for skill maintenance, and a demonstration of how STIX-structured forensic intelligence and LLM-assisted analysis can be integrated into examiner workflows. Everything operates on synthetic or publicly released practice data inside isolated environments, which keeps the entire program firmly in the educational and authorized-assessment domain.

Weaknesses are honest and few: the base VM image pins to Kali 2021.4, tooling will drift from current distributions over time, and the Docker path is flagged by the authors themselves as requiring additional testing. But as a living, grant-funded, frequently updated corpus spanning disk, memory, network, mobile, IoT, and AI-assisted forensics, digital-forensics-lab is one of the strongest free resources an authorized security team can pull from when building the next generation of examiners.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• nmap-vulners for turning service scans into ranked CVE and exploit intelligence


• TrollFools for in-place tweak injection on TrollStore iOS devices


• Inside Pentest-Windows: itm4ns research notes on Windows internals and exploitation