# ferchoweb/frankwxu-digital-forensics-lab architecture

> Architecture diagram of the GitHub repository ferchoweb/frankwxu-digital-forensics-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ferchoweb/frankwxu-digital-forensics-lab
- Repository: https://github.com/ferchoweb/frankwxu-digital-forensics-lab

## Overview

This repository is a teaching collection for digital forensics, not one integrated application. Its principal user workflow is a learner following a lab or case study, using its materials and scripts to examine evidence or demonstrate a forensic technique. The visible code spans disk-image partition inspection, XML exercises, network-forensics demonstrations, Echo snapshots, and AI-assisted IP identification. The tree and sampled source support only a partial runtime map; many README-listed labs and integrations have no corresponding files here, so their wiring is not inferred.

Main entry points: [`Networking_Forensics/lab_files/ARP_spoofing/arp.py`](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/ARP_spoofing/arp.py) (ARP Spoofing), [`Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py`](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py) (Packet Filtering), [`AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py`](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py) (Dataset Preprocessing), [`NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py`](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py) (Partition Listing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_evidence["Evidence Exercises"]
  node_partition_listing["Partition Listing<br/>[list_partitions.py]"]
  node_disk_image["Disk Image"]
  node_xml_exercises["XML Exercises"]
  node_xml_file["Bookstore XML"]
end

subgraph group_network["Network Forensics"]
  node_arp_demo["ARP Spoofing<br/>[arp.py]"]
  node_dns_demo["DNS Spoofing<br/>[dns_spoof.py]"]
  node_firewall_demo["Packet Filtering"]
  node_syn_demo["SYN Flood Demo<br/>[synflood.py]"]
  node_wep_demo["WEP Key Recovery"]
end

subgraph group_ai["AI Forensics"]
  node_ai_preprocess["Dataset Preprocessing"]
  node_ai_training["Fine-tune Training"]
  node_ai_prediction["IP Prediction"]
  node_ai_evaluation["Model Evaluation<br/>[model_accuracy.py]"]
  node_dataset_csv["CSV Dataset"]
  node_dataset_jsonl["Train and Test JSONL"]
end

subgraph group_iot["Mobile and IoT"]
  node_echo_snapshots["Echo Snapshots"]
end

subgraph group_skills["Computer Skills"]
  node_file_carving["USB File Carving<br/>[Ballardlab8.java]"]
  node_regex_examples["Regex Examples"]
end

node_learner(("Learner"))
node_network(("Network"))
node_scapy["Scapy Packet Tools"]
node_packet_queue["Netfilter Queue"]
node_iptables["iptables"]
node_gpu_hashing["GPU and SHA-1"]

node_learner -->|"runs"| node_partition_listing
node_partition_listing -->|"reads"| node_disk_image
node_learner -->|"runs"| node_xml_exercises
node_xml_exercises -->|"reads or updates"| node_xml_file
node_learner -->|"runs"| node_arp_demo
node_arp_demo -->|"sends ARP"| node_scapy
node_arp_demo -->|"queries and spoofs"| node_network
node_learner -->|"runs"| node_dns_demo
node_learner -->|"runs"| node_firewall_demo
node_firewall_demo -->|"adds and removes rule"| node_iptables
node_firewall_demo -->|"binds and handles"| node_packet_queue
node_learner -->|"runs"| node_syn_demo
node_syn_demo -->|"sends packets"| node_scapy
node_learner -->|"runs"| node_wep_demo
node_wep_demo -->|"checks candidates"| node_gpu_hashing
node_learner -->|"runs"| node_ai_preprocess
node_ai_preprocess -->|"reads"| node_dataset_csv
node_ai_preprocess -->|"writes"| node_dataset_jsonl
node_learner -->|"runs"| node_ai_training
node_learner -->|"runs"| node_ai_prediction
node_learner -->|"runs"| node_ai_evaluation
node_learner -->|"examines"| node_echo_snapshots
node_learner -->|"uses in lab"| node_file_carving
node_learner -->|"uses in lab"| node_regex_examples

click node_partition_listing "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py"
click node_xml_exercises "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml"
click node_arp_demo "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/ARP_spoofing/arp.py"
click node_dns_demo "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/dns_spoof/dns_spoof.py"
click node_firewall_demo "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py"
click node_syn_demo "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/SYN_Flood/synflood.py"
click node_wep_demo "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU_Improved_v1.py"
click node_ai_preprocess "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py"
click node_ai_training "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/create_fine_tune_job.py"
click node_ai_prediction "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/predict_ip_single_line.py"
click node_ai_evaluation "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/Calculate_Confusion_Matrix/code/model_accuracy.py"
click node_echo_snapshots "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/Echo_Device/lab_data/Lab_4_1_2/snapshots"
click node_file_carving "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Basic_Computer_Skills_for_Forensics/file_carving/usb_file/Ballardlab8.java"
click node_regex_examples "https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/Basic_Computer_Skills_for_Forensics/regex"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_partition_listing,node_disk_image,node_xml_exercises,node_xml_file toneBlue
class node_arp_demo,node_dns_demo,node_firewall_demo,node_syn_demo,node_wep_demo toneAmber
class node_ai_preprocess,node_ai_training,node_ai_prediction,node_ai_evaluation,node_dataset_csv,node_dataset_jsonl toneMint
class node_echo_snapshots,node_packet_queue toneRose
class node_file_carving,node_regex_examples,node_learner,node_network,node_scapy,node_iptables,node_gpu_hashing toneIndigo
```

## Components

### Evidence Exercises

- [Partition Listing](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py): `NIST_Data_Leakage_Case/py_version/pycode/list_partitions.py`
- **Disk Image**
- [XML Exercises](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml): `NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml`
- **Bookstore XML**

### Network Forensics

- [ARP Spoofing](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/ARP_spoofing/arp.py): `Networking_Forensics/lab_files/ARP_spoofing/arp.py`
- [DNS Spoofing](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/dns_spoof/dns_spoof.py): `Networking_Forensics/lab_files/dns_spoof/dns_spoof.py`
- [Packet Filtering](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py): `Networking_Forensics/lab_files/firewall/iptables_handle_packets_drop.py`
- [SYN Flood Demo](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/SYN_Flood/synflood.py): `Networking_Forensics/lab_files/SYN_Flood/synflood.py`
- [WEP Key Recovery](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU_Improved_v1.py): `Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU_Improved_v1.py`

### AI Forensics

- [Dataset Preprocessing](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py): `AI4Forensics/IP_Identifier_Fine_Tuning/code/preprocess_dataset.py`
- [Fine-tune Training](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/create_fine_tune_job.py): `AI4Forensics/IP_Identifier_Fine_Tuning/code/create_fine_tune_job.py`
- [IP Prediction](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/code/predict_ip_single_line.py): `AI4Forensics/IP_Identifier_Fine_Tuning/code/predict_ip_single_line.py`
- [Model Evaluation](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/AI4Forensics/IP_Identifier_Fine_Tuning/Calculate_Confusion_Matrix/code/model_accuracy.py): `AI4Forensics/IP_Identifier_Fine_Tuning/Calculate_Confusion_Matrix/code/model_accuracy.py`
- **CSV Dataset**
- **Train and Test JSONL**

### Mobile and IoT

- [Echo Snapshots](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/Echo_Device/lab_data/Lab_4_1_2/snapshots): `Echo_Device/lab_data/Lab_4_1_2/snapshots`

### Computer Skills

- [USB File Carving](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/blob/main/Basic_Computer_Skills_for_Forensics/file_carving/usb_file/Ballardlab8.java): `Basic_Computer_Skills_for_Forensics/file_carving/usb_file/Ballardlab8.java`
- [Regex Examples](https://github.com/ferchoweb/frankwxu-digital-forensics-lab/tree/main/Basic_Computer_Skills_for_Forensics/regex): `Basic_Computer_Skills_for_Forensics/regex`

### Other components

- **Learner**
- **Network**
- **Scapy Packet Tools**
- **Netfilter Queue**
- **iptables**
- **GPU and SHA-1**

## Connections

- Learner → Partition Listing: runs
- Partition Listing → Disk Image: reads
- Learner → XML Exercises: runs
- XML Exercises → Bookstore XML: reads or updates
- Learner → ARP Spoofing: runs
- ARP Spoofing → Scapy Packet Tools: sends ARP
- ARP Spoofing → Network: queries and spoofs
- Learner → DNS Spoofing: runs
- Learner → Packet Filtering: runs
- Packet Filtering → iptables: adds and removes rule
- Packet Filtering → Netfilter Queue: binds and handles
- Learner → SYN Flood Demo: runs
- SYN Flood Demo → Scapy Packet Tools: sends packets
- Learner → WEP Key Recovery: runs
- WEP Key Recovery → GPU and SHA-1: checks candidates
- Learner → Dataset Preprocessing: runs
- Dataset Preprocessing → CSV Dataset: reads
- Dataset Preprocessing → Train and Test JSONL: writes
- Learner → Fine-tune Training: runs
- Learner → IP Prediction: runs
- Learner → Model Evaluation: runs
- Learner → Echo Snapshots: examines
- Learner → USB File Carving: uses in lab
- Learner → Regex Examples: uses in lab