hemu1438/forensicsgpt-training-data huggingface dataset:
2018 Lone Wolf – Digital Corpora
We are pleased to announce a new scenario in the digitalcorpora family!
Released today is the 2018 Lone Wolf Scenario, created by GMU student Thomas Moore. The scenario consists of more than 32GB (compressed) of data that was seized from a fictional individual who was planning a mass shooting.
The 2018 Lone Wolf Scenario is based on a (fictional) unstable individual who is planning a mass shooting. The individual is interrupted when a family member calls the police and his apartment is raided. The task for the investigators is to determine if anyone else was involved.
This scenario contains a disk image and memory dump from a laptop. Itâ€™s an image of a real, physical machine that was actually used, so itâ€™s quite big. Also included in the scenario are the results of modern commercial digital forensics tools applied to the dataset, so that students who donâ€™t have access to these tools can still see their results. There is a teacherâ€™s guide that includes a report on all of the planted evidence.
The 2018 Lone Wolf Scenario was created by Thomas J. Moore, a student at George Mason University.
Please remember: this is a fictional scenario about fictional people!
Unlike the other scenarios on our website, this scenario also includes output of commercial forensic tools for student use. The idea is that there is nothing especially creative about running evidence through a tool, and a lot of students do not have access to state-of-the-art commercial tools, so we have run the tools for your students!
A teacher’s guide is available for this scenario.
You can find more information about the 2018 Lone Wolf scenario here: https://digitalcorpora.org/corpora/scenarios/2018-lone-wolf-scenario
M57-Patents Scenario is Available – Digital Corpora
The M57-Patents scenario is now available. This scenario includes nearly a terabyte of information with 50 disk images, memory dumps, and network packets. There are three specific crimes in the scenario that can be solved, but there are also collections of data that can be used to enable a variety of computer forensics research projects and tool development.
The scenario is split up into many pieces so you can download just what you need.
You can download it from
hashdb toolset – Digital Corpora
The text file govdocs1-first512-first4096-docid.txt containing MD5 hashes of the first 512 bytes and first 4096 bytes of every file in the GOVDOCS1 corpus has been removed. This file was provided to assist with research of block hashes. We have since created the hashdb toolset which provides support for creating and working with hash block databases.Â Please refer to https://github.com/simsong/hashdb/wiki for downloading the code, continuing progress on this topic, and links to relevant papers including:
Distinct Sector Hashes for Target File Detection
A related masters thesis on this topic was completed at Naval Postgraduate School in 2012 and can be downloaded for additional reading: https://simson.net/ref/2012/kmf_thesis.pdf
Android 13 Image – Digital Corpora
Leave a Reply 
Your email address will not be published. Required fields are marked *
Comment * 
You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> 
 <strike> <strong> 
Save my name, email, and website in this browser for the next time I comment.
Notify me of follow-up comments by email.
Notify me of new posts by email.
35GB of JPEGs ready for download – Digital Corpora
We have created a tarÂ and a ZIP file with 109,223 files from the govdocs1m corpus. You can download them from:
https://downloads.digitalcorpora.org/corpora/files/govdocs1/by_type/files.jpeg.tarÂ Â [37.6 GB]
Browse all by type: https://downloads.digitalcorpora.org/corpora/files/govdocs1/by_type/
Please note that the ZIP file is necessarily a ZIP-64 file and will not decompress with the ZIP implementation built-in to MacOS or Windows.
test disk image of emails available – Digital Corpora
I have created a new disk image called 2010-nps-emails that can be used for testing programs that find email addresses or perform string search.
The disk image consists of 30 different email addresses, each one stored in a different document with a different coding scheme.
Below are a list of the email addresses and their codings:
email address                             Application (Encoding)

plain_text@textedit.com                   Apple TextEdit  (UTF-8)
plain_text_pdf@textedit.com               Apple TextEdit print-to-PDF (/FlateDecode)
rtf_text@textedit.com                     Apple TextEdit (RTF)
rtf_text_pdf@textedit.com                 Apple TextEdit print-to-PDF (/FlateDecode)
plain_utf16@textedit.com                  Apple TextEdit (UTF-16)
plain_utf16_pdf@textedit.com              Apple TextEdit print-to-PDF (/FlateDecode)

pages@iwork09.com                         Apple Pages '09
pages_comment@iwork09.com                 Apple Pages (comment) '09
keynote@iwork09.com                       Apple Keynote '09
keynote_comment@iwork09.com               Apple Keynote '09 (comment)
numbers@iwork09.com                       Apple Numbers '09
numbers_comment@iwork09.com               Apple Numbers '09 (comment)

user_doc@microsoftword.com                Microsoft Word 2008 (Mac) (.doc file)
user_doc_pdf@microsoftword.com            Microsoft Word 2008 (Mac) print-to-PDF
user_docx@microsoftword.com
user_docx_pdf@microsoftword.com           Microsoft Word 2008 (Mac) print-to-PDF (.docx file)
xls_cell@microsoft_excel.com
xls_comment@microsoft_excel.com           Microsoft Word 2008 (Mac)
xlsx_cell@microsoft_excel.com             Microsoft Word 2008 (Mac)
xlsx_comment@microsoft_excel.com          Microsoft Word 2008 (Mac) (Comment)

doc_within_doc@document.com               Microsoft Word 2007 (OLE .doc file within .doc)
docx_within_docx@document.com             Microsoft Word 2007 (OLE .doc file within .doc)
ppt_within_doc@document.com               Microsoft PowerPoint and Word 2007 (OLE .ppt file within .doc)
pptx_within_docx@document.com             Microsoft PowerPoint and Word 2007 (OLE .pptx file within .docx)
xls_within_doc@document.com               Microsoft Excel and Word 2007 (OLE .xls file within .doc)
xlsx_within_docx@document.com             Microsoft Excel and Word 2007 (OLE .xlsx file within .docx)

email_in_zip@zipfile1.com                 text file within ZIP
email_in_zip_zip@zipfile2.com             ZIP'ed text file, ZIP'ed
email_in_gzip@gzipfile.com                text file within GZIP
email_in_gzip_gzip@gzipfile.com           GZIP'ed text file, GZIP'ed
The image can be downloaded from nps-2010-emails
Edit, 2011-11-26 19:32 PST: One email was incorrectly recorded above. xlsx_comment@microsoft_excel.com is within the disk image, but xlsx_cell_comment@microsoft_excel.com was recorded here. That is now corrected above.
Please try the new corpora browser – Digital Corpora
We are moving to a new corpora browser that is running on the digitalcorpora web server, scans through the AWS S3 bucket, and serves up AWS S3 https:// links.
You can try the new browser here: https://downloads.digitalcorpora.org/corpora/
Please submit comments and requests here: https://github.com/digitalcorpora/app/issues.
ISO 9660 disk images from anti-forensics.ru posted – Digital Corpora
Our friends at anti-forensics.ru have given us seven very small disk images that are designed to demonstrate failings of particular open source Linux distributions.
You can view all of the images at https://digitalcorpora.org/corp/images/aor/. The images you will find there includes:
2009-aor-test_caine15.iso
2009-aor-test_deft5.iso
2009-aor-test_grml200910.iso
2009-aor-test_othernew.iso
2009-aor-test_otherold.iso
2009-aor-test_raptor20091026.iso
2009-aor-test_spada4.iso
These images should be directly copied to a hard drive or a partition. Forensic Linux distributions would use them as root file systems and execute proof-of-concept code during the boot.
Details of why these images are useful can be found on the author’s website, at: Linux_for_computer_forensic_investigators_2.pdf
DigitalCorpora is now available on Amazon S3 – Digital Corpora
You can download any file using this new base URL: https://downlods.digitalcorpora.org/corpora/
For example, corpus file drives/nps-2014-xbox1/narrative.txt can be downloaded from:
https://downloads.digitalcorpora.org/corpora/drives/nps-2014-xbox1/narrative.txt
You can browse the DigitalCorpora S3 bucket using our browser at https://downloads.digitalcorpora.org/corpora/.
You can also use our JavaScript browser: https://digitalcorpora.org/s3_browser.html
2009 M57-Patents Scenario – Digital Corpora
The 2009-M57-Patents scenario tracks the first four weeks of corporate history of the M57 Patents company. The company started operation on Friday, November 13th, 2009, and ceased operation on Saturday, December 12, 2009. As might be imagined in the business of outsourced patent searching, lots of other activities were going on at M57-Patents.
Two ways of working the scenario are as a disk forensics exercise (students are provided with disk images of all the systems as they were on the last day) and as a network forensics exercise (students are provided with all of the packets in and out of the corporate network). The scenario data can also be used to support computer forensics research, as the hard drive of each computer and each computer’s memory were imaged every day.
All of the materials below can be found at https://downloads.digitalcorpora.org/corpora/scenarios/2009-m57-patents/
Instructor Materials and Answer Keys (encrypted):
m57-instructor-packet.pdf
hash-sets.zip
scenario-emails.zip
Exercise slides:
M57-Patents-Illegal.key
M57-Patents-Illegal.ppt
M57-Patents-Illegal.pdf
M57-Patents-Exfiltration.key
M57-Patents-Exfiltration.ppt
M57-Patents-Exfiltration.pdf
M57-Patents-Eavesdropping.key
M57-Patents-Eavesdropping.ppt
M57-Patents-Eavesdropping.pdf
Detective reports, warrant and affidavit:
detectivereport1.doc
detectivereport1.pdf
detectivereport2.doc
detectivereport2.pdf
detectivereport3.doc
detectivereport3.pdf
detectivereport4.doc
detectivereport4.pdf
m57-affidavit-warrant-final.doc
m57-affidavit-warrant-final.pdf
Individual items from the corpus organized by calendar date as they were produced during the scenario can also be found here:
Redacted Drive Images
USB Drive Images
RAM Images
Network Traffic
Documentation
Notes:
Friday, 13 November has no images, because the scenario did not officially start until the following Monday (16 November). Your data may contain drive images from Thursday, 12 November. These are for reference (e.g. prior to any employee activity).
Friday, 20 December has images for two separate drives for Jo and Terry. See the scenario information for that date. The “Police Evidence” torrents contain only the second drive image.
Finally, we have made available some files resulting from processing the corpus with our other research tools:
Output of bulk_extractor version 1.3 against the M57 disk images: 
We have prepared a variety of supporting materials for this scenario, including sample exercises, instructor slides, simulated detective reports and associated warrant, and encrypted scenario guides, hash tables, and answer keys for instructors. The solution is distributed as an encrypted PDF file.
Please see our note on obtaining solutions.
DigitalCorpora has joined the AWS Open Data Sponsorship Program! – Digital Corpora
The DigitalCorpora project recently joined the AWS Open Data Sponsorship Program. This means that big changes are underway, and they are all for the better!
Under the Open Data program, we will be transitioning the digitalcorpora corpus to storage in Amazon S3. We will have a gateway to preserve the existing links at https://downloads.digitalcorpora.org/corpora/, but the gateway will redirect you to an AWS S3 download. We will also be adding TTS for downloads.
This means that the download server will be more stable moving forward. It will also make it much easier (and faster) to analyze the corpus from the Amazon Cloudâ€”and all forensics should be done in the cloud, right?
We’ve been hosting the downloads server at George Mason University since 2015 and it’s been a great ride! We will probably keep the GMU downloads server operational as our backup downloads server for the next year or two.
As preparation for the migration, we will be removing all symbolic links from the downloads server. Currently, the following symbolic links are in use:
dcorpora@digitalcorpora:~/corpora$ ls -l `find . -type l -print`
lrwxrwxrwx 2 dcorpora apache  6 May 16  2015 ./cell-phones -> mobile
lrwxrwxrwx 2 dcorpora apache  6 May 16  2015 ./disk-images -> drives
lrwxrwxrwx 1 dcorpora apache 22 Aug 19  2019 ./mobile/2019-owl -> ../scenarios/2019-owl/
lrwxrwxrwx 2 dcorpora apache  7 May 16  2015 ./network-packet-dumps -> packets
lrwxrwxrwx 1 dcorpora apache 33 Jul 18 09:16 ./scenarios/2008-m57-jean -> ../disk-images/nps-2008-m57-jean/
lrwxrwxrwx 1 dcorpora apache 23 Aug 18  2019 ./scenarios/2008-nitroba -> ../packets/2008-nitroba
lrwxrwxrwx 2 dcorpora apache 42 May 17  2015 ./scenarios/2009-m57-patents/drives-redacted -> ../../drives/nps-2009-m57-patents-redacted
lrwxrwxrwx 2 dcorpora apache 30 May 17  2015 ./scenarios/2009-m57-patents/net -> ../../packets/2009-m57-patents
lrwxrwxrwx 2 dcorpora apache 30 May 17  2015 ./scenarios/2009-m57-patents/ram -> ../../ram/nps-2009-m57-patents
lrwxrwxrwx 2 dcorpora apache 33 May 17  2015 ./scenarios/2009-m57-patents/usb -> ../../drives/nps-2009-patents/usb
int dcorpora@digitalcorpora:~/corpora$
This will be resolved as followings:
The cell-phones, disk-images and network-packet-dumps links will be removed.
The proper home for 2019-owl will be under scenarios/; a file 2019-owl.txt will be left behind in the /mobile directory.
All of the m57 data will be moved under the scenario. As above, text files will be left behind
Announcing New File Type Sample Files – Digital Corpora
UT San Antonio has kindly provided digitalcorpora with open source, publicly releasable samples of 32 file types. These are the samples that were used by Dr. Nicole Beebe to develop the Sceadan File Type Classifier.
Included file types are ASP, AVI, B64, B85, BZ2, CSS, DLL, ELF, EXE, EXT3, FAT, FLV, JAR, JB2, JS, M4A, MOV, MP3, MP4, NTFS, PST, RPM, RTF, Random, SWF, TXT, Tbird, URL, WAV, WMA, XLSX, ZIP. Each file type sample can be downloaded from the website:
* https://downloads.digitalcorpora.org/corpora/files/filetypes1/
Also included is a _README directory that includes a list of every file downloaded and a copyright statement for the files that are covered under copyright. You can access that directory at:
* https://downloads.digitalcorpora.org/corpora/files/filetypes1/_README/
This “FLETYPES1” corpus supplements the files in the GOVDOCS1 corpus.
Please let us know if you use these by including this citation in your paper:
“FILETYPES1 File type samples,” Beebe, Nicole, University of Texas, San Antonio, hosted at https://downloads.digitalcorpora.org/corpora/files/filetypes1/. 2014
New Teacher’s Guide for 2008-Nitroba – Digital Corpora
Leave a Reply 
Your email address will not be published. Required fields are marked *
Comment * 
You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> 
 <strike> <strong> 
Save my name, email, and website in this browser for the next time I comment.
Notify me of follow-up comments by email.
Notify me of new posts by email.
First 512 and 4096 byte block hashes of govdocs1 – Digital Corpora
I have posted a text file containing MD5 hashes for the first 512 bytes and first 4096 bytes of every file in the GOVDOCS1 corpus. This file is intended for research on sector hashing. You can download the file from https://downloads.digitalcorpora.org/corpora/files/govdocs1/govdocs1-first512-first4096-docid.txt
Server Problems – Digital Corpora
Leave a Reply 
Your email address will not be published. Required fields are marked *
Comment * 
You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> 
 <strike> <strong> 
Save my name, email, and website in this browser for the next time I comment.
Notify me of follow-up comments by email.
Notify me of new posts by email.
Terms of Use Published! – Digital Corpora
Leave a Reply 
Your email address will not be published. Required fields are marked *
Comment * 
You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> 
 <strike> <strong> 
Save my name, email, and website in this browser for the next time I comment.
Notify me of follow-up comments by email.
Notify me of new posts by email.
2019 Owl – Digital Corpora
Scenario
In a jurisdiction where Owls are illegal to trade and buy, two users are discussing the illegal trade of owls. The computer and mobile device taken into evidence are of a user who is attempting to purchase owls illegally. The user has contacted another user who can provide an owl in exchange for cash. An owl is decided upon, and an exchange is scheduled. After the exchange, a communication message is sent confirming the owl purchase has been completed.
Evidence
Top-level evidence directory
Michael Hamm – Digital Corpora
CIRCL Forensics Exercises are little challenges developed for and during the CIRCL Forensics Trainings, and for workshops or presentations. Usually you will find a PDF with the slides and the solution inline, next to a disk image with the challenge itself.
Wiped Disk Image:
https://downloads.digitalcorpora.org/corpora/drives/circl-2023-wiped/
Recovering data from a wiped disk sounds impossible. But wiping a ‘big’ disk would take time. If the adversary is not patient and interrupts the wiping process after some limited time, there is a good chance to recover some plain data, or even complete file system structures and/or partitions. Goal of this exercise is, to recover data from a partially wiped disk image.
This is a manual approach, to learn how to analyze data on byte level.
To be continued
Downloads has been transitioned from GMU to S3! – Digital Corpora
We have transitioned https://downloads.digitalcorpora.org/corpora/ from George Mason University to Amazon S3. The transition should be completed by 0445 GMT Feb 3, 2021. When the transition is finished, you will also be able to access digitalcorpora at https://downloads.digitalcorpora.org/corpora/.
The old downloads system can still be accessed at https://gmu.digitalcorpora.org/corpora/
simsong – Digital Corpora
Our friends at anti-forensics.ru have given us seven very small disk images that are designed to demonstrate failings of particular open source Linux distributions.
You can view all of the images at https://digitalcorpora.org/corp/images/aor/. The images you will find there includes:
2009-aor-test_caine15.iso
2009-aor-test_deft5.iso
2009-aor-test_grml200910.iso
2009-aor-test_othernew.iso
2009-aor-test_otherold.iso
2009-aor-test_raptor20091026.iso
2009-aor-test_spada4.iso
These images should be directly copied to a hard drive or a partition. Forensic Linux distributions would use them as root file systems and execute proof-of-concept code during the boot.
Details of why these images are useful can be found on the author’s website, at: Linux_for_computer_forensic_investigators_2.pdf
Ever want to have SQL access to the NIST RDS but didn’t want to spend a month building the MySQL tables? Well, we did too… So we took one of our 8-core, 32GB servers, imported all of the NSRL, and then put a tar file of the tables available for download on this server.
To use these files just download https://downloads.digitalcorpora.org/corpora/files/nist-nsrl-rds226.tar.bz2 and put the files in your MySQL data directory. You’ll be up-and-running in no time.
General – Page 2 – Digital Corpora
A new corpus has been added to the collection by Sven Schmitt and Sebastian Nemetz. A link to the details encompassing this corpus can be found here. 
A new set of Android 10 images and files have been contributed to the collection by Joshua Hickman. Details can be found here.
We have published a Terms of Use for the digitalcorpora website.
Due to changes at our hosting provider, request for solutions made between June 1, 2019 and August 1, 2019 may have been lost. If you made a request during this time and did not receive a response, please submit another one! We apologize for the inconvenience.
Thanks to Joshua Hickman at the Digital Evidence Section of the North Carolina Department of Justice, we now have three Andoird images available for download: Android 7, Android 8 and Android 9.
Our downloads server is operational again! Thanks to George Mason University for continuing to host this resource!
We are having problems with our download server! Files are not available until further notice.
The website has been transitioned to Dreamhost. The downloads remain at George Mason University and can be reached at https://downloads.digitalcorpora.org/corpora/ for the corpora and https://downloads.digitalcorpora.org/downloads/ for files.
We are happy to announce the contribution of four disk images of a non-deterministic USB drive. Read More.
CIRCL – Digital Corpora
CIRCL Forensics Exercises are little challenges developed for and during the CIRCL Forensics Trainings, and for workshops or presentations. Usually you will find a PDF with the slides and the solution inline, next to a disk image with the challenge itself.
Wiped Disk Image:
https://downloads.digitalcorpora.org/corpora/drives/circl-2023-wiped/
Recovering data from a wiped disk sounds impossible. But wiping a ‘big’ disk would take time. If the adversary is not patient and interrupts the wiping process after some limited time, there is a good chance to recover some plain data, or even complete file system structures and/or partitions. Goal of this exercise is, to recover data from a partially wiped disk image.
This is a manual approach, to learn how to analyze data on byte level.
To be continued
iso9660 – Digital Corpora
Our friends at anti-forensics.ru have given us seven very small disk images that are designed to demonstrate failings of particular open source Linux distributions.
You can view all of the images at https://digitalcorpora.org/corp/images/aor/. The images you will find there includes:
2009-aor-test_caine15.iso
2009-aor-test_deft5.iso
2009-aor-test_grml200910.iso
2009-aor-test_othernew.iso
2009-aor-test_otherold.iso
2009-aor-test_raptor20091026.iso
2009-aor-test_spada4.iso
These images should be directly copied to a hard drive or a partition. Forensic Linux distributions would use them as root file systems and execute proof-of-concept code during the boot.
Details of why these images are useful can be found on the author’s website, at: Linux_for_computer_forensic_investigators_2.pdf
NSRL – Digital Corpora
Ever want to have SQL access to the NIST RDS but didn’t want to spend a month building the MySQL tables? Well, we did too… So we took one of our 8-core, 32GB servers, imported all of the NSRL, and then put a tar file of the tables available for download on this server.
To use these files just download https://downloads.digitalcorpora.org/corpora/files/nist-nsrl-rds226.tar.bz2 and put the files in your MySQL data directory. You’ll be up-and-running in no time.