hemu1438/forensicsgpt-training-data huggingface dataset:
Extended DOS Partition Test
Digital Forensics Tool Testing Image (#1)
http://dftt.sourceforge.net 
Introduction
Most DOS partition tools will not allow the user to create a third entry in an extended partition. A test image was created by modifying the partition table by hand with a hex editor and the system was booted. Both Windows and Linux read the third entry in the extended partition table and allowed the user to mount the partition. This test was to verify that forensic tools also allowed the investigator to view the partition in the third entry. 
Download
This test image is a 'raw' disk image (i.e. 'dd'). The disk is 150MB and is compressed to 160KB. This image is released under the GPL, so anyone can use it. 
zip 
Layout
The following is the partition layout of the disk image. A tool should show all six FAT16 partitions. Each partition has a file in it whose name corresponds to the partition. Each file has zero size. 
Table EntryStartEndLengthDescription 
Primary Table #1	
00	0000000063	0000052415	0000052353	DOS FAT16 (0x04)	
01	0000052416 	0000104831 	0000052416 	DOS FAT16 (0x04)	
02 	0000104832 	0000157247 	0000052416 	DOS FAT16 (0x04)	
03 	0000157248 	0000312479 	0000155232 	DOS Extended (0x05)	
Extended Table #1	
00 	0000157311 	0000209663 	0000052353 	DOS FAT16 (0x04)	
01 	0000209727 	0000262079 	0000052353 	DOS FAT16 (0x04)	
02 	0000262080 	0000312479 	0000050400 	DOS Extended (0x05)	
Extended Table #2	
00	0000262143 	0000312479 	0000050337 	DOS FAT16 (0x06)	
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test image. This test was released on July 24, 2003. 
Disclaimers
Neither Purdue University or CERIAS sponsor this work. 
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Brian Carrier [carrier AT cerias.purdue.edu] 	Last Updated: Aug 25, 2003
NTFS Keyword Search Test #1
Digital Forensics Tool Testing Image (#3)
http://dftt.sourceforge.net 
Introduction
This test image is an NTFS file system with several ASCII strings. The goal of this test is less ambitious than the previous FAT keyword search test and only tests the unique features of NTFS. It only has 10 test cases and there will likely be another test image in the future that tests additional features of NTFS. The focus of this test is resident versus non-resident file content and multiple data attributes (or alternate data streams). 
Download
This test image is a 'raw' partition image (i.e. 'dd') of an NTFS file system. The file system is 8MB and is compressed to 6MB. The MD5 of the image is 389e42124eb23c5053ff6596976d6710. This image is released under the GPL, so anyone can use it. 
zip 
Search Terms
These should all be performed case sensitive and not as regular expressions. 
NumStringSectorOffsetFileNote 
1	r-alloc	1342	83	$LogFile	Log File Entry	
	r-alloc	5409	347	file-r-1.dat	Resident allocated file	
2	r-unalloc	1350	92	$LogFile	Log File Entry #1	
	r-unalloc	1915	156	$LogFile	Log File Entry #2	
	r-unalloc	5423	380	file-r-2.dat (deleted)	Resident unallocated file	
3	r-fads	1391	43	$LogFile	Log File Entry	
	r-fads	5414	331	file-r-3.dat:here	Resident alternate data stream in an allocated file	
4	r-dads	1528	258	$LogFile	Log File Entry	
	r-dads	5415	346	dir-r-4:there	Resident alternate data stream in an allocated directory	
5	n-alloc	8050	161	file-n-1.dat	Non-resident allocated file	
6	n-unalloc	8053	86	file-n-2.dat (deleted)	Non-resident unallocated file	
7	n-frag	8059	509	file-n-3.dat	Crosses fragmented clusters in a non-resident allocated file	
8	n-slack	8062	485	file-n-4.dat	Slack space of a non-resident allocated file	
9	n-fads	8067	370	file-n-5.dat:here	Non-resident alternate data stream in an allocated file	
10	n-dads	8068	314	dir-n-6:there	Non-resident alternate data stream in an allocated directory	
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test cases and the test image. This test was released on October 27, 2003. 
Disclaimers
Neither Purdue University or CERIAS sponsor this work. 
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Brian Carrier [carrier AT cerias.purdue.edu] 	Last Updated: Oct 27, 2003
EXT3FS Keyword Search Test #1
Digital Forensics Tool Testing Image (#4)
http://dftt.sourceforge.net 
Introduction
This test image is an EXT3FS file system with several ASCII strings. There are only 4 strings to search for, so this one is quite simple and short. It only tests the basic features of EXT3FS. 
Download
This test image is a 'raw' partition image (i.e. 'dd') of an EXT3FS file system. The file system is 5MB and is compressed to 4MB. The MD5 of the image is 30e7f792cc853e34e17335b243605d3a. This image is released under the GPL, so anyone can use it. 
zip 
Search Terms
These should all be performed case sensitive and not as regular expressions. Results Form 
NumStringSector - OffsetFragment - OffsetFileNote 
1	first	330 - 100	165 - 100	/, /., /.., /lost+found/..	File Name	
	first	392 - 100	196 - 100	inode #8	Journal entry	
	first	432 - 100	216 - 100	inode #8	Journal entry	
	first	2416 - 181	1208 - 181	/file1	Allocated file	
2	second	2419 - 509	1209 - 1021	/file2	Fragmented String	
3	third	2420 - 80	1210 - 80	/file3 (deleted)	Unallocated file	
4	slacker	2417 - 179	1208 - 691	/file1	Slack space of file1	
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test cases and the test image. This test was released on November 24, 2003. 
Disclaimers
Neither Purdue University or CERIAS sponsor this work. 
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Brian Carrier [carrier AT cerias.purdue.edu] 	Last Updated: Nov 23, 2003
FAT Daylight Savings Test
Digital Forensics Tool Testing Image (#5)
http://dftt.sourceforge.net 
Introduction
This test image is a FAT12 floppy image with two files. One was created in the winter and the other in the summer. This image will test how a tool processes the times. FAT saves dates and times in a format that is not sensitive to timezones. If the tool translates the FAT time to a timezone-sensitive format, then errors could exist. 
Download
This test image is a 'raw' partition image (i.e. 'dd') of an FAT12 file system. The MD5 of the image is 9fb582f3361ba0bc5a3b0f7c17a082cb. This image is released under the GPL, so anyone can use it. 
zip 
Files
There are two files. The contents of each file contains the time that it was created. Note that the results of this test may differ depending on which season you run the test. The results may also vary if the timezone of your analysis tools are set to one that does not use daylight savings. 
NameCreated Date 
winter.txt	January 1, 2004 - 2:00PM	
summer.txt	June 1, 2004 - 3:00PM	
If the tool is not working, then it will likely show a 2 hour difference between the files. The correct time may vary depending on the time of year. 
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test cases and the test image. This test was released on January 29, 2004. 
Disclaimers
Neither Purdue University or CERIAS sponsor this work. 
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Brian Carrier [carrier AT cerias.purdue.edu] 	Last Updated: Jan 29, 2004
NTFS Undelete Test #1
NTFS Undelete (and leap year) Test #1
Digital Forensics Tool Testing Image (#7)
http://dftt.sourceforge.net 
Introduction
This test image is a 6MB NTFS file system with eight deleted files, two deleted directories, and a deleted alternate data stream. The files range from resident files, single cluster files, and multiple fragments. No data structures were modified in this process to thwart recovery. They were created in Windows XP, deleted in XP, and imaged in Linux. 
Download
This test image is a 'raw' partition image (i.e. 'dd') of a NTFS file system. The file system is 6MB and is compressed to 186 KB (lots of zeros). The MD5 of the image is e7dbb96759d9cd62b729463ebfe61dab. This image is released under the GPL, so anyone can use it. 
zip 
Files
These are the files that should be recovered, their sizes, and their MD5 values. (Fill in the blank results form) 
NumMFT EntryNameSizeMD5Note 
1	37	\res1.dat	101	9036637712b491904cd0bfbdbe648453	Resident file (data is stored in MFT entry and not in a cluster)	
2	31	\sing1.dat	780	59b20779f69ff9f0ac5fcd2c38835a79	single cluster file	
3	32-128-3	\mult1.dat	3801	ffd27bd782bdce67750b6b9ee069d2ef	multiple cluster, non-fragmented file	
4	32-128-6	\mult1.dat:ADS	1234	ba1b9eedb1c091ddca253d35dde8f616	multiple cluster, second data attribute (Alternate Data Stream)	
5	29	\frag1.dat	1584	7a3bc5b763bef201202108f4ba128149	fragmented file	
6	30	\frag2.dat	3873	0e80ab84ef0087e60dfc67b88a1cf13e	fragmented file with frag1.dat mixed in	
7	33	\dir1\	1024	N/A	directory	
8	36	\dir1\mult2.dat	1715	59cf0e9cd107bc1e75afb7374f6e05bb	multiple cluster, non-fragmented in deleted directory	
9	34	\dir1\dir2\	1024	N/A	directory in deleted directory	
10	35	\dir1\dir2\frag3.dat	2027	21121699487f3fbbdb9a4b3391b6d3e0	fragmented file in deleted directories	
11	38	\dir3\sing2.dat	1005	c229626f6a71b167ad7e50c4f2fccdb1	single cluster file in a directory whose MFT entry has been reallocated (to res1.dat)	
Layout
Here is the actual layout of the image. 
ClusterFile 
4073	\frag1.dat (part 1 of 2)	
4074	\frag2.dat (part 1 of 3)	
4075	\frag1.dat (part 2 of 2)	
4076-4077	\frag2.dat (part 2 of 3)	
4078	\sing1.dat	
4079-4082	\mult1.dat	
4083-4084	\mult1.dat:ADS	
4085	\frag2.dat (part 3 of 3)	
4086-4089	\$Secure:$SDH (Not deleted)	
4090	\dir1\dir2\frag3.dat (part 1 of 2)	
4091-4092	\dir1\mult2.dat	
4093	\dir1\dir2\frag3.dat (part 2 of 2)	
4094	\dir3\sing2.dat	
Bonus
This image was created on Feb 29, 2004 so check the dates in your tools to see if your tool properly handles leap year. 
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test cases and the test image. This test was released on February 29, 2004. 
Disclaimers
Neither Purdue University or CERIAS sponsor this work. 
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Brian Carrier [carrier AT cerias.purdue.edu] 	Last Updated: Mar 24, 2004
FAT Volume Label Test #1
Digital Forensics Tool Testing Image (#9)
http://dftt.sourceforge.net 
Introduction
This test image is a FAT file system that has been modified using a hex editor. The modifications were made to determine how tools deal with images that have abnormal volume labels. I have found that the consistency checking under Windows XP allows several scenarios that, according to the FAT specification, should not be allowed. This test image has some of those illegal situations and contains hidden data. 
Download
This test image is a 'raw' partition image (i.e. 'dd') of a FAT file system. The file system is 10MB and is compressed to 120 KB. The MD5 of the image is aa834dca822918de45792f4e115516b9. This image is released under the GPL, so anyone can use it. 
zip 
Environment
This section will describe what changes were made to the image. This form can be used to test your tool with these changes. 
The volume label in the boot sector is "LABEL1"
The directory entry in the root directory with the volume label attribute set is named "LABEL2". Its MD5 value is 8071eeaa52cd372a9bbb093e348e605c.
The directory entry in the dir1 directory with the volume label attribute set is named "FILE2.DLL". Its MD5 value is 8aeca328aa6fbb7d2ec01f8c2f3e4bbd.
Both of the directory entries with the volume label attribute set have clusters allocated to them. One is random data with the string "over here" and the other is a JPEG.
The check disk in Windows XP was run on the file system before acquisition and no errors were found
Author
Brian Carrier (carrier at cerias.purdue.edu) created the test cases and the test image. This test was released on August 22, 2004. 
Disclaimers
These tests are not a complete test suite. These were some of the first ones that I thought of and little formal theory was put into their design. 
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!). 
Copyright © 2004 by Brian Carrier
Email: carrier at users dot sf dot net 		Last Updated: August 22, 2004
Basic Data Carving Test #1
(by Nick Mikus)
Digital Forensics Tool Testing Image (#11)
http://dftt.sourceforge.net 
Introduction
This test image is a FAT32 file system and is intended to test data carving tools and their ability to extract various file formats. The image contains several allocated and deleted files and the header one JPEG file was modified ( to show the importance of ignoring corrupted files). All files are random files that that were in my possession or that I created from scratch. This image was created from a USB thumb-drive that was wiped and formatted using the mkfs.vfat program. The FAT boot sector has been corrupted so that the image cannot be mounted and therefore data carving methods must be used to extract the files. 
Download
This test image is a 'raw' partition image (i.e. 'dd') of a FAT32 file system. The file system is 62MB and is compressed to 11MB. The MD5 of the image is 0069813c892a462f88dc6d376624f7d9. This image is released under the GPL, so anyone can use it. 
zip 
Files
The following files and the MD5 hash and description were created on the file system.
Num
	
Name
	
MD5
	
Size
	
Note
	
Sectors
	
1
	
2003_document.doc
	
e72f388b36f9370f19696b164c308482
	
19968 
	
A Valid DOC file
	(0-38) 281 -320	
2
	
enterprise.wav
	
7629b89adade055f6783dc1773274215  
	
318895 
	
A valid WAV file
	(0-622) 16021 -16644	
3
	
haxor2.jpg
	
84e1dceac2eb127fef5bfdcb0eae324b
	
24367 
	
An invalid JPEG with only 1 header byte corrupted. This byte is located at offset 19 within the file. 
	(0-47)16645 -16692	
4
	
holly.xls
	
7917baf0219645afef8b381570c41211
	
23040 
	
A valid XLS file
	(0-44) 16693-16738	
5
	
lin_1.2.pdf
	
e026ec863410725ba1f5765a1874800d
	
1399508
	
A linearized PDF
	(0-2733) 16741 -19475	
6
	
nlin_14.pdf
	
5b3e806e8c9c06a475cd45bf821af709
	
122434 
	
A non-linearized PDF
	(0-239) 19477 -19716	
7
	
paul.jpg
	
37a49f97ed279832cd4f7bd002c826a2
	
29885 
	
A valid jpeg
	(0-58) 19717 -19776	
8
	
pumpkin.jpg
	
6c9859e5121ff54d5d6298f65f0bf3b3
	
444314
	
A valid EXIF jpeg 
	(0-867) 19777-20644	
9
	
shark.jpg
	
d83428b8742a075b57b0dc424cd297c4
	
99298 
	
A valid JPEG
	(0-193) 20645-20839	
10
	
sm1.gif
	
d25fb845e6a41395adaed8bd14db7bf2  
	
5498 
	
A valid GIF
	(0-10) 20841-20852	
11
	
surf.mov
	
5328d2b066f428ea95b2793849ab97fa
	
550653 
	
A valid MOV
	(0-1075) 20853-21928	
12
	
surf.wmv
	
ff085d0c4d0e0fdc8f3427db68e26266
	
1036994 
	
A valid WMV
	(0-2025) 21929-23955	
13
	
test.ppt
	
7b74c2c608d92f4bb76c1d3b6bd1decc
	
11264 
	
A deleted PPT
	(0-21) 23957 -23978	
14
	
wword60t.zip
	
c0be59d49b7ee0fdc492d2df32f2c6c6
	
78899
	
A valid ZIP 
	(0-154) 23981 -24135	
15
	
domopers.wmv
	
63c0c6986cf0a446cb54b0ac65a921a5
	
8037267
	
A deleted wmv
	(0-15697) 321-16018	
Author
Nick Mikus (nick.mikus at gmail.com) created the test cases and the test image. This test was released on March 14, 2005. 
Disclaimers
This is a simple test case I composed when testing data carving tools. It is by no means all inclusive.
		Last Updated: March 14, 2005
Basic Data Carving Test #2
This test image is an EXT2 file system and is intended to test data carving tools for indirect block detection and removal. With large files, EXT2 allocates blocks (called indirect blocks) to store file metadata and the blocks are frequently allocated in between blocks that contain file content. Therefore, the file becomes fragmented and a basic carving tool may include the indirect block in the carved file. This file system image contains several allocated and deleted files, none of which have been modified. This image was created from a USB thumb drive that was wiped clean and formatted using the mkfs.ext2 program. The super block has been corrupted so that the image cannot be mounted and therefore data carving methods must be used to extract the files.
This test image is a 'raw' partition image (i.e. 'dd') of an EXT2 file system. The file system is 124MB and is compressed to 1.1MB. The MD5 of the image is 6cbd2c5248fa7030d699eb6cde051623. This image is released under the GPL, so anyone can use it. 
The following files exist in the image. The sectors marked as "(IND)" and "(DIND)" represent the indirect and double indirect block pointer locations.
Num
	
Name
	
MD5
	
Size
	
Note
	
Sectors
	
1
	
haxor2.bmp 
	
f9633fe6b9ef2a0a5edd6de70d22c0f5
	
163878
	
A deleted BMP
	
(0-22):5162-5184, (IND):5186, (24-320):5188-5484
	
2
	
jimmy.doc
	
2f3f914dd74819df42d1d941c7275c16
	
12800
	
A deleted DOC
	
(0-22):5486-5508, (IND):5510, (24):5512
	
3
	
jn.jpg
	
270a0a913fa9603db8121fdf78d63aca
	
28949
	
A valid JPG
	
(0-22):5514-5536, (IND):5538, (24-56):5540-5572
	
4
	
lin_test.pdf
	
1c64456776075d1f0a662e1f6c09e340
	
26618
	
A valid PDF
	
(0-22):5574-5596, (IND):5598, (24-50):5600-5626
	
5
	
main_dive.jpg
	
937846adb96773ee25fcb34821230976
	
8463
	
A valid jpeg
	
(0-16):5628-5644
	
6
	
n_lin_ss.pdf
	
97be95ed3e710b63bc75e5c0775062d9
	
734652
	
A valid pdf
	
(0-22):5646-5668, (IND):5670, (24-534):5672-6182, (DIND):6184, (IND):6186, (536-1046):6188-6698, (IND):6700, (1048-1434)6702-7088
	
7
	
blogo.gif
	
5e10b2176016885a85bffc074a142524
	
18663
	
A valid gif
	
(0-22):5122-5144, (IND):5146, (24-36):5148-5160
	
8
	
sherry.jpg
	
3834e72d2ee266ccfb9733d716b89f2b
	
133249
	
A valid JPEG
	
(0-22):7090-7112, (IND):7114, (24-260):7116-7352
	
9
	
stats.xls
	
6351df9c1543c41c3df8eea63e06a219
	
15360
	
A valid XLS
	
(0-22):7354-7376, (IND):7378, (24-28):7380-7384
	
10
	
test.ppt
	
99941c129cc8cfbadc15c55086982efc
	
17408
	
A valid PPT
	
(0-22):7386-7408, (IND):7410, (24-32):7412-7420
	
This is a simple test case I composed when testing data carving tools. It is by no means all inclusive.
Windows Memory Analysis #1
(by Jesse Kornblum, ManTech)
Digital Forensics Tool Testing Image (#13)
http://dftt.sourceforge.net 
Introduction
Memory analysis is becoming an important part of a digital investigation. This test set contains memory images of several Windows systems in different environments. They are released so that there can be a common set of images for researchers to use for development and for practitioners to use for evaluation of their tools. 
Download
There are two memory images in a 'raw' format. They were not engaged in any malicious or even network based activity at the time of imaging. 
boomer-win2003: Windows 2003 SP0 installed on a standalone machine named Boomer. Not activated. Running Notepad. 1GB of memory. (zip)
boomer-win2k: Windows 2000 SP0 installed on a standalone machine named Boomer. Note that this image contains several possible System EPROCESS blocks. The "correct" block is at offset 0x5d008e0. Running a command prompt, WordPad, and Notepad. 1GB of memory. (zip) 
These images are released under the GPL, so anyone can use them. 
Author
Jesse Kornblum (web [at] jessekornblum [dot] com) (ManTech) created the test images. This test was released on January 6, 2007 (although Jesse gave them to me several months before and I forgot to upload them...). 
		Last Updated: February 23, 2007
EXT3FS Keyword Search Test #1


1. Search string: first
How many hits: 

For each hit:
Sector or Fragment and Offset:
File Name: 


2. Search String: second
How many hits:

For each hit:
Sector or Fragment and Offset:
File Name: 


3. Search String: third
How many hits:

For each hit:
Sector or Fragment and Offset:
File Name: 


4. Search String: slacker
How many hits:

For each hit:
Sector or Fragment and Offset:
File Name: 


5.  Can the deleted file '/file3' be seen in the file listing?
JPEG Search Test #1

Tool: 
Version: 


1.  What search procedure(s) were used to obtain the following
results?


The following apply to the results from running an automated search
tool for JPEG pictures.  If more than one procedure was used to
find the images, please note the procedure that was used to find
each.  Note that this was not designed to test data carving tools.


2. Did the search results include the alloc\file1.jpg picture?  


3. Did the search results include the alloc\file2.dat picture?  If
not, then is it documented that JPEGs are found using only the
extension?


4. Did the search results include the invalid\file3.jpg file?


5. Did the search results include the invalid\file4.jpg file?


6. Did the search results include the invalid\file5.rtf file?


7. Did the search results include the deleted picture in MFT entry
#32 (del1/file6.jpg)?  If not, then is it documented that only
allocated JPEGs will be found?


8. Did the search results include the deleted picture in MFT entry
#31 (del2/file7.hmm)?  If this file was not found, but the file in
step #7 was found, then is it documented that only JPEGs with a
proper extension will be found?


9. Did the search results include the picture inside of archive\file8.zip?
If not, then is it documented that JPEG files will be found and
that JPEG images that are embedded inside other file types will
not?


10. Did the search results include the picture inside of
archive\file9.boo?  If not, then is it documented that JPEG files
will be found and that JPEG images that are embedded inside other
file types will not?


11. Did the search results include the picture inside of
archive\file10.tar.gz?  If not, then is it documented that JPEG
files will be found and that JPEG images that are embedded inside
other file types will not?


12. Did the search results include the misc\file11.dat file?  If
not, then is it documented that JPEG files will be found and that
JPEG images that are embedded inside other file types will not?


13. Did the search results include the misc\file12.doc file?  If
not, then is it documented that JPEG files will be found and that
JPEG images that are embedded inside other file types will not?


14. Did the search results include the misc\file13.dll:here picture?
If not, then is it documented that pictures in alternate data streams
will not be found?
FAT Undelete Image #1

Tool: 
Version: 

1.  Can you see the frag1.dat, frag2.dat, sing.dat, mult1.dat, and
dir1 file and directory names in the root directory?

2.  Can you see the dir2 and mult2.dat names in the dir1 directory?

3.  Can you see the frag3.dat name in the dir1\dir2 directory?

4.  Can you recover the sing.dat file?  Does it have the correct MD5?

5.  Can you recover the mult1.dat file?  Does it have the correct MD5?

6.  Can you recover the dir1\mult2.dat file?  Does it have the
correct MD5?

7.  Can you recover the frag1.dat file?  Does it have the correct MD5?

8.  Can you recover the frag2.dat file?  Does it have the correct MD5?

9.  Can you recover the dir1\dir2\frag3.dat file?  Does it have the
correct MD5?