How ferchoweb/frankwxu-digital-forensics-lab works
This repository is a teaching collection for digital forensics, not one integrated application. Its principal user workflow is a learner following a lab or case study, using its materials and scripts to examine evidence or demonstrate a forensic technique. The visible code spans disk-image partition inspection, XML exercises, network-forensics demonstrations, Echo snapshots, and AI-assisted IP identification. The tree and sampled source support only a partial runtime map; many README-listed labs and integrations have no corresponding files here, so their wiring is not inferred.
Main entry points: arp.py ARP Spoofing · iptables_handle_packets_drop.py Packet Filtering · preprocess_dataset.py Dataset Preprocessing · list_partitions.py Partition Listing
Components 24
Evidence Exercises
- Partition Listing
NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py - Disk Image
- XML Exercises
NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml - Bookstore XML
Network Forensics
- ARP Spoofing
Networking_Forensics/lab_files/ARP_spoofing/arp.py - DNS Spoofing
Networking_Forensics/lab_files/dns_spoof/dns_spoof.py - Packet Filtering
Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py - SYN Flood Demo
Networking_Forensics/lab_files/SYN_Flood/synflood.py - WEP Key Recovery
Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU_Improved_v1.py
AI Forensics
- Dataset Preprocessing
AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py - Fine-tune Training
AI4Forensics/IP_Identifier_Fine_Tuning/code/create_fine_tune_job.py - IP Prediction
AI4Forensics/IP_Identifier_Fine_Tuning/code/predict_ip_single_line.py - Model Evaluation
AI4Forensics/IP_Identifier_Fine_Tuning/Calculate_Confusion_Matrix/code/model_accuracy.py - CSV Dataset
- Train and Test JSONL
Mobile and IoT
- Echo Snapshots
Echo_Device/lab_data/Lab_4_1_2/snapshots
Computer Skills
- USB File Carving
Basic_Computer_Skills_for_Forensics/file_carving/usb_file/Ballardlab8.java - Regex Examples
Basic_Computer_Skills_for_Forensics/regex
Other components
- Learner
- Network
- Scapy Packet Tools
- Netfilter Queue
- iptables
- GPU and SHA-1
Connections 24
- Learner → Partition Listing: runs
- Partition Listing → Disk Image: reads
- Learner → XML Exercises: runs
- XML Exercises → Bookstore XML: reads or updates
- Learner → ARP Spoofing: runs
- ARP Spoofing → Scapy Packet Tools: sends ARP
- ARP Spoofing → Network: queries and spoofs
- Learner → DNS Spoofing: runs
- Learner → Packet Filtering: runs
- Packet Filtering → iptables: adds and removes rule
- Packet Filtering → Netfilter Queue: binds and handles
- Learner → SYN Flood Demo: runs
- SYN Flood Demo → Scapy Packet Tools: sends packets
- Learner → WEP Key Recovery: runs
- WEP Key Recovery → GPU and SHA-1: checks candidates
- Learner → Dataset Preprocessing: runs
- Dataset Preprocessing → CSV Dataset: reads
- Dataset Preprocessing → Train and Test JSONL: writes
- Learner → Fine-tune Training: runs
- Learner → IP Prediction: runs
- Learner → Model Evaluation: runs
- Learner → Echo Snapshots: examines
- Learner → USB File Carving: uses in lab
- Learner → Regex Examples: uses in lab