# itzz-inbathamizhans/digital_forensics_lab architecture

> Architecture diagram of the GitHub repository itzz-inbathamizhans/digital_forensics_lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-08-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/itzz-inbathamizhans/digital_forensics_lab
- Repository: https://github.com/itzz-inbathamizhans/digital_forensics_lab

## Overview

#### Purpose and Entry Points
This is a documentation-and-artifact repository for ten hands-on digital-forensics lab experiments, spanning acquisition, recovery, traffic analysis, host examination, mobile/logical analysis, steganography, and reverse engineering. The root `README.md` defines the portfolio scope; each experiment is entered through its local README, such as `Experiment-01-FTK-Imager/README.md`, `Experiment-05-Autopsy/README.md`, and `Experiment-10-Ghidra/README.md`.

#### Experiment-Oriented Architecture
The repository is organized as independent, tool-specific lab units rather than a runnable application. Each unit generally couples procedure/report documents with screenshots and, where preserved, analysis outputs. Primary experiment boundaries are directory-level: `Experiment-01-FTK-Imager`, `Experiment-02-TestDisk`, `Experiment-03-Wireshark`, `Experiment-05-Autopsy`, and `Experiment-06-Sleuth-Kit`.

#### Acquisition and Volatile-Evidence Stage
The FTK Imager experiment covers disk-image and memory-acquisition evidence, with recorded result artifacts at `Experiment-01-FTK-Imager/Results/Disk_image_result.txt` and `Experiment-01-FTK-Imager/Results/VolatilityWorkbenchLog.txt`. This establishes a key evidence boundary: acquired media/memory are inputs to later forensic tools, while screenshots under `Experiment-01-FTK-Imager/Screenshots` document operator actions.

#### Recovery and File-System Analysis
Recovery-focused workflows are represented by TestDisk and Sleuth Kit experiments: `Experiment-02-TestDisk/README.md` and `Experiment-06-Sleuth-Kit/README.md`. These stages consume storage evidence, inspect file-system structures, and recover or validate deleted/partition-level artifacts. Results and screenshots are retained separately under `Experiment-02-TestDisk/Results` and `Experiment-02-TestDisk/Screenshots`.

#### Network Evidence Analysis
Wireshark is the network-forensics branch. Its preserved packet-capture input/output is `Experiment-03-Wireshark/Results/Captured_File.pcapng`, with procedural context in `Experiment-03-Wireshark/README.md`. The material boundary is a PCAPNG capture analyzed externally in Wireshark; no in-repository parser or service processes the traffic.

#### Case Management and Artifact Processing
Autopsy is the most stateful investigation package. The case definition and local case database are stored in `Experiment-05-Autopsy/Results/Inba_Investgation/Inba_Investgation.aut` and `Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db`. Its analysis pipeline persists module outputs, including registry/recent-activity extraction at `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/RecentActivity`, image-gallery data at `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/Image Gallery/drawable.db`, and Prefetch output at `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/prefetch`.

#### Reporting, Supporting Analyses, and Runtime Boundaries
The Autopsy workflow culminates in an Excel report at `Experiment-05-Autopsy/Results/Inba_Investgation/Reports/Inba_Investgation Excel Report 08-06-2026-22-23-18/Excel.xlsx`. Additional standalone labs cover mobile/logical analysis, steganography, process inspection, and binary reverse engineering through `Experiment-07-AF-Logical/README.md`, `Experiment-08-Steganography/README.md`, `Experiment-09-Process-Explorer/README.md`, and `Experiment-10-Ghidra/README.md`. Material runtimes are external forensic desktop tools—FTK Imager, Volatility Workbench, TestDisk, Wireshark, Autopsy/Sleuth Kit, Process Explorer, and Ghidra—not code or infrastructure hosted by this repository.

Main entry points: [`README.md`](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/README.md) (Portfolio scope), [`Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db`](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db) (Autopsy case database), [`Experiment-01-FTK-Imager/README.md`](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/README.md) (FTK Imager lab), [`Experiment-01-FTK-Imager/Results/Disk_image_result.txt`](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/Results/Disk_image_result.txt) (Disk and memory evidence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_portfolio["Portfolio"]
  node_root_readme["Portfolio scope<br/>README<br/>[README.md]"]
end

subgraph group_evidence["Evidence workflows"]
  node_ftk_lab["FTK Imager lab<br/>acquisition lab<br/>[README.md]"]
  node_acquired_evidence[("Disk and memory evidence<br/>acquisition results")]
  node_volatility_log["Volatility log<br/>memory analysis output"]
  node_testdisk_lab["TestDisk lab<br/>recovery lab<br/>[README.md]"]
  node_testdisk_results[("Recovery results<br/>recovery artifacts")]
  node_wireshark_lab["Wireshark lab<br/>network analysis lab<br/>[README.md]"]
  node_packet_capture[("Packet capture<br/>PCAPNG evidence")]
  node_sleuth_kit_lab["Sleuth Kit lab<br/>file-system analysis lab<br/>[README.md]"]
end

subgraph group_autopsy["Autopsy case"]
  node_autopsy_case["Autopsy case definition<br/>case file"]
  node_autopsy_db[("Autopsy case database<br/>[autopsy.db]")]
  node_recent_activity[("Recent activity output<br/>module output")]
  node_image_gallery[("Image gallery database<br/>module output<br/>[drawable.db]")]
  node_prefetch_output[("Prefetch output<br/>module output")]
  node_excel_report["Excel investigation report<br/>[Excel.xlsx]"]
end

subgraph group_standalone["Standalone labs"]
  node_mobile_lab["AF Logical lab<br/>mobile analysis lab<br/>[README.md]"]
  node_steganography_lab["Steganography lab<br/>[README.md]"]
  node_process_lab["Process Explorer lab<br/>host process lab<br/>[README.md]"]
  node_ghidra_lab["Ghidra lab<br/>reverse-engineering lab<br/>[README.md]"]
end

node_root_readme -->|"indexes"| node_ftk_lab
node_root_readme -->|"indexes"| node_testdisk_lab
node_root_readme -->|"indexes"| node_wireshark_lab
node_root_readme -->|"includes investigation"| node_autopsy_case
node_root_readme -->|"indexes"| node_sleuth_kit_lab
node_root_readme -->|"indexes"| node_mobile_lab
node_root_readme -->|"indexes"| node_steganography_lab
node_root_readme -->|"indexes"| node_process_lab
node_root_readme -->|"indexes"| node_ghidra_lab
node_ftk_lab -->|"records acquisition"| node_acquired_evidence
node_ftk_lab -->|"records memory analysis"| node_volatility_log
node_acquired_evidence -.->|"storage evidence input"| node_testdisk_lab
node_acquired_evidence -.->|"file-system evidence input"| node_sleuth_kit_lab
node_testdisk_lab -->|"produces"| node_testdisk_results
node_wireshark_lab -->|"analyzes"| node_packet_capture
node_autopsy_case -->|"persists case state"| node_autopsy_db
node_autopsy_db -->|"generates"| node_recent_activity
node_autopsy_db -->|"generates"| node_image_gallery
node_autopsy_db -->|"generates"| node_prefetch_output
node_recent_activity -->|"contributes findings"| node_excel_report
node_image_gallery -->|"contributes findings"| node_excel_report
node_prefetch_output -->|"contributes findings"| node_excel_report

click node_root_readme "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/README.md"
click node_ftk_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/README.md"
click node_acquired_evidence "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/Results/Disk_image_result.txt"
click node_volatility_log "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/Results/VolatilityWorkbenchLog.txt"
click node_testdisk_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-02-TestDisk/README.md"
click node_testdisk_results "https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-02-TestDisk/Results"
click node_wireshark_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-03-Wireshark/README.md"
click node_packet_capture "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-03-Wireshark/Results/Captured_File.pcapng"
click node_sleuth_kit_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-06-Sleuth-Kit/README.md"
click node_autopsy_case "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/Inba_Investgation.aut"
click node_autopsy_db "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db"
click node_recent_activity "https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/RecentActivity"
click node_image_gallery "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/Image%20Gallery/drawable.db"
click node_prefetch_output "https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/prefetch"
click node_excel_report "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/Reports/Inba_Investgation%20Excel%20Report%2008-06-2026-22-23-18/Excel.xlsx"
click node_mobile_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-07-AF-Logical/README.md"
click node_steganography_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-08-Steganography/README.md"
click node_process_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-09-Process-Explorer/README.md"
click node_ghidra_lab "https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-10-Ghidra/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_root_readme toneBlue
class node_ftk_lab,node_acquired_evidence,node_volatility_log,node_testdisk_lab,node_testdisk_results,node_wireshark_lab,node_packet_capture,node_sleuth_kit_lab toneAmber
class node_autopsy_case,node_autopsy_db,node_recent_activity,node_image_gallery,node_prefetch_output,node_excel_report toneMint
class node_mobile_lab,node_steganography_lab,node_process_lab,node_ghidra_lab toneRose
```

## Components

### Portfolio

- [Portfolio scope](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/README.md): README · Defines the ten-experiment forensic lab portfolio. · `README.md`

### Evidence workflows

- [FTK Imager lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/README.md): acquisition lab · `Experiment-01-FTK-Imager/README.md`
- [Disk and memory evidence](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/Results/Disk_image_result.txt): acquisition results · `Experiment-01-FTK-Imager/Results/Disk_image_result.txt`
- [Volatility log](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-01-FTK-Imager/Results/VolatilityWorkbenchLog.txt): memory analysis output · `Experiment-01-FTK-Imager/Results/VolatilityWorkbenchLog.txt`
- [TestDisk lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-02-TestDisk/README.md): recovery lab · `Experiment-02-TestDisk/README.md`
- [Recovery results](https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-02-TestDisk/Results): recovery artifacts · `Experiment-02-TestDisk/Results`
- [Wireshark lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-03-Wireshark/README.md): network analysis lab · `Experiment-03-Wireshark/README.md`
- [Packet capture](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-03-Wireshark/Results/Captured_File.pcapng): PCAPNG evidence · Captured traffic analyzed externally in Wireshark. · `Experiment-03-Wireshark/Results/Captured_File.pcapng`
- [Sleuth Kit lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-06-Sleuth-Kit/README.md): file-system analysis lab · `Experiment-06-Sleuth-Kit/README.md`

### Autopsy case

- [Autopsy case definition](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/Inba_Investgation.aut): case file · `Experiment-05-Autopsy/Results/Inba_Investgation/Inba_Investgation.aut`
- [Autopsy case database](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db): case database · `Experiment-05-Autopsy/Results/Inba_Investgation/autopsy.db`
- [Recent activity output](https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/RecentActivity): module output · Registry and recent-activity extraction. · `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/RecentActivity`
- [Image gallery database](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/Image%20Gallery/drawable.db): module output · `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/Image Gallery/drawable.db`
- [Prefetch output](https://github.com/itzz-inbathamizhans/digital_forensics_lab/tree/main/Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/prefetch): module output · `Experiment-05-Autopsy/Results/Inba_Investgation/ModuleOutput/prefetch`
- [Excel investigation report](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-05-Autopsy/Results/Inba_Investgation/Reports/Inba_Investgation%20Excel%20Report%2008-06-2026-22-23-18/Excel.xlsx): report · `Experiment-05-Autopsy/Results/Inba_Investgation/Reports/Inba_Investgation Excel Report 08-06-2026-22-23-18/Excel.xlsx`

### Standalone labs

- [AF Logical lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-07-AF-Logical/README.md): mobile analysis lab · `Experiment-07-AF-Logical/README.md`
- [Steganography lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-08-Steganography/README.md): steganography lab · `Experiment-08-Steganography/README.md`
- [Process Explorer lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-09-Process-Explorer/README.md): host process lab · `Experiment-09-Process-Explorer/README.md`
- [Ghidra lab](https://github.com/itzz-inbathamizhans/digital_forensics_lab/blob/main/Experiment-10-Ghidra/README.md): reverse-engineering lab · `Experiment-10-Ghidra/README.md`

## Connections

- Portfolio scope → FTK Imager lab: indexes
- Portfolio scope → TestDisk lab: indexes
- Portfolio scope → Wireshark lab: indexes
- Portfolio scope → Autopsy case definition: includes investigation
- Portfolio scope → Sleuth Kit lab: indexes
- Portfolio scope → AF Logical lab: indexes
- Portfolio scope → Steganography lab: indexes
- Portfolio scope → Process Explorer lab: indexes
- Portfolio scope → Ghidra lab: indexes
- FTK Imager lab → Disk and memory evidence: records acquisition
- FTK Imager lab → Volatility log: records memory analysis
- Disk and memory evidence → TestDisk lab: storage evidence input
- Disk and memory evidence → Sleuth Kit lab: file-system evidence input
- TestDisk lab → Recovery results: produces
- Wireshark lab → Packet capture: analyzes
- Autopsy case definition → Autopsy case database: persists case state
- Autopsy case database → Recent activity output: generates
- Autopsy case database → Image gallery database: generates
- Autopsy case database → Prefetch output: generates
- Recent activity output → Excel investigation report: contributes findings
- Image gallery database → Excel investigation report: contributes findings
- Prefetch output → Excel investigation report: contributes findings