itzz-inbathamizhans/digital_forensics_lab

Purpose and Entry Points

This is a documentation-and-artifact repository for ten hands-on digital-forensics lab experiments, spanning acquisition, recovery, traffic analysis, host examination, mobile/logical analysis, steganography, and reverse engineering. The root README.md defines the portfolio scope; each experiment is entered through its local README, such as Experiment-01-FTK-Imager/README.md, Experiment-05-Autopsy/README.md, and Experiment-10-Ghidra/README.md.

Experiment-Oriented Architecture

The repository is organized as independent, tool-specific lab units rather than a runnable application. Each unit generally couples procedure/report documents with screenshots and, where preserved, analysis outputs. Primary experiment boundaries are directory-level: Experiment-01-FTK-Imager, Experiment-02-TestDisk, Experiment-03-Wireshark, Experiment-05-Autopsy, and Experiment-06-Sleuth-Kit.

Acquisition and Volatile-Evidence Stage

The FTK Imager experiment covers disk-image and memory-acquisition evidence, with recorded result artifacts at Experiment-01-FTK-Imager/Results/Disk_image_result.txt and Experiment-01-FTK-Imager/Results/VolatilityWorkbenchLog.txt. This establishes a key evidence boundary: acquired media/memory are inputs to later forensic tools, while screenshots under Experiment-01-FTK-Imager/Screenshots document operator actions.

Recovery and File-System Analysis

Recovery-focused workflows are represented by TestDisk and Sleuth Kit experiments: Experiment-02-TestDisk/README.md and Experiment-06-Sleuth-Kit/README.md. These stages consume storage evidence, inspect file-system structures, and recover or validate deleted/partition-level artifacts. Results and screenshots are retained separately under Experiment-02-TestDisk/Results and Experiment-02-TestDisk/Screenshots.

Network Evidence Analysis

Wireshark is the network-forensics branch. Its preserved packet-capture input/output is Experiment-03-Wireshark/Results/Captured_File.pcapng, with procedural context in Experiment-03-Wireshark/README.md. The material boundary is a PCAPNG capture analyzed externally in Wireshark; no in-repository parser or service processes the traffic.

Case Management and Artifact Processing

Autopsy is the most stateful investigation package. The case definition and local case database are stored in Experiment-05-Autopsy/Results/Inba_Investgation/Inba_Investgation.aut and Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db. Its analysis pipeline persists module outputs, including registry/recent-activity extraction at Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/RecentActivity, image-gallery data at Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/Image Gallery/drawable.db, and Prefetch output at Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/prefetch.

Reporting, Supporting Analyses, and Runtime Boundaries

The Autopsy workflow culminates in an Excel report at Experiment-05-Autopsy/Results/Inba_Investgation/Reports/Inba_Investgation Excel Report 08-06-2026-22-23-18/Excel.xlsx. Additional standalone labs cover mobile/logical analysis, steganography, process inspection, and binary reverse engineering through Experiment-07-AF-Logical/README.md, Experiment-08-Steganography/README.md, Experiment-09-Process-Explorer/README.md, and Experiment-10-Ghidra/README.md. Material runtimes are external forensic desktop tools—FTK Imager, Volatility Workbench, TestDisk, Wireshark, Autopsy/Sleuth Kit, Process Explorer, and Ghidra—not code or infrastructure hosted by this repository.