# Forensic Challenges

[https://www.amanhardikar.com/mindmaps/ForensicChallenges.html](https://www.amanhardikar.com/mindmaps/ForensicChallenges.html)



<figure><img src="https://1889614651-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLrtG_g25xt3AUhomb%2Fuploads%2FoFbDAdlENPL0B6DJhxMf%2Fimage.png?alt=media&#x26;token=529b1b8d-457b-4386-9266-10bdb535c48e" alt=""><figcaption></figcaption></figure>



<table data-full-width="true"><thead><tr><th>URLs</th><th></th></tr></thead><tbody><tr><td>Host Forensics</td><td></td></tr><tr><td>Computer Forensic Investigation</td><td><a href="http://www.shortinfosec.net/2008/07/competition-computer-forensic.html">http://www.shortinfosec.net/2008/07/competition-computer-forensic.html/</a></td></tr><tr><td>Digital Forensics Tool Testing Images</td><td><a href="http://dftt.sourceforge.net/">http://dftt.sourceforge.net/</a></td></tr><tr><td>DigitalCorpora</td><td><a href="http://digitalcorpora.org/">http://digitalcorpora.org/</a></td></tr><tr><td>DFRWS 2014 Forensics Rodeo</td><td><a href="http://www.cs.uno.edu/~golden/dfrws-2014-rodeo.html">http://www.cs.uno.edu/~golden/dfrws-2014-rodeo.html</a></td></tr><tr><td>ForGe Forensic test image generator</td><td><a href="https://github.com/hannuvisti/forge">https://github.com/hannuvisti/forge</a></td></tr><tr><td>ISFCE Sample Practical Exercise</td><td><a href="http://www.isfce.com/sample-pe.htm">http://www.isfce.com/sample-pe.htm</a></td></tr><tr><td>Linux LEO Supplemental Files</td><td><a href="http://linuxleo.com/">http://linuxleo.com/</a></td></tr><tr><td>NIST CFREDS</td><td><a href="http://www.cfreds.nist.gov/dfr-test-images.html">http://www.cfreds.nist.gov/dfr-test-images.html</a><br><a href="http://www.cfreds.nist.gov/Hacking_Case.html">http://www.cfreds.nist.gov/Hacking_Case.html</a></td></tr><tr><td>p0wnlabs Sample Challenges</td><td><a href="http://www.p0wnlabs.com/free/forensics">http://www.p0wnlabs.com/free/forensics</a></td></tr><tr><td>Samples from Automating DFIR Series</td><td><a href="http://www.hecfblog.com/2015/02/automating-dfir-how-to-series-on.html">http://www.hecfblog.com/2015/02/automating-dfir-how-to-series-on.html</a></td></tr><tr><td>volatility memory samples</td><td><a href="https://code.google.com/p/volatility/wiki/FAQ">https://code.google.com/p/volatility/wiki/FAQ</a></td></tr><tr><td>Network Forensics</td><td></td></tr><tr><td>Chris Sanders Packet Captures</td><td><a href="http://chrissanders.org/packet-captures/">http://chrissanders.org/packet-captures/</a></td></tr><tr><td>DigitalCorpora Packet Dumps</td><td><a href="http://digitalcorpora.org/corpora/packet-dumps">http://digitalcorpora.org/corpora/packet-dumps</a></td></tr><tr><td>Enron Email Dataset</td><td><a href="http://www.cs.cmu.edu/~enron/">http://www.cs.cmu.edu/~enron/</a></td></tr><tr><td>Ethereal Sample Captures</td><td><a href="http://www.stearns.org/toolscd/current/pcapfile/README.ethereal-pcap.html">http://www.stearns.org/toolscd/current/pcapfile/README.ethereal-pcap.html</a></td></tr><tr><td>Evil Fingers PCAP Challenges</td><td><a href="https://www.evilfingers.com/repository/pcaps_challenge.php">https://www.evilfingers.com/repository/pcaps_challenge.php</a></td></tr><tr><td>Kholia's Packet Captures</td><td><a href="https://github.com/kholia/my-pcaps">https://github.com/kholia/my-pcaps</a></td></tr><tr><td>LBNL-FTP-PKT</td><td><a href="http://ee.lbl.gov/anonymized-traces.html">http://ee.lbl.gov/anonymized-traces.html/</a></td></tr><tr><td>MAWI Working Group Traffic Archive</td><td><a href="http://mawi.wide.ad.jp/mawi/">http://mawi.wide.ad.jp/mawi/</a></td></tr><tr><td>PacketLife Capture Collection</td><td><a href="http://packetlife.net/captures/">http://packetlife.net/captures/</a></td></tr><tr><td>pcapr</td><td><a href="http://www.pcapr.net/">http://www.pcapr.net</a></td></tr><tr><td>PCAPS Repository</td><td><a href="https://github.com/markofu/pcaps">https://github.com/markofu/pcaps</a></td></tr><tr><td>SANS DFIR Challenge</td><td><a href="https://digital-forensics.sans.org/community/challenges">https://digital-forensics.sans.org/community/challenges</a></td></tr><tr><td>Spy Hunter Holiday Challenge</td><td><a href="http://blog.mywarwithentropy.com/2015/11/spy-hunter-holiday-challenge-2015.html">http://blog.mywarwithentropy.com/2015/11/spy-hunter-holiday-challenge-2015.html</a><br><a href="http://blog.mywarwithentropy.com/2014/11/spy-hunter-holiday-challenge-2014.html">http://blog.mywarwithentropy.com/2014/11/spy-hunter-holiday-challenge-2014.html</a></td></tr><tr><td>Tcpreplay Sample Captures</td><td><a href="http://tcpreplay.appneta.com/wiki/captures.html">http://tcpreplay.appneta.com/wiki/captures.html</a></td></tr><tr><td>Wireshark Network Analysis Book Supplements</td><td><a href="http://www.wiresharkbook.com/studyguide.html">http://www.wiresharkbook.com/studyguide.html</a></td></tr><tr><td>Wireshark Sample Captures</td><td><a href="http://wiki.wireshark.org/SampleCaptures">http://wiki.wireshark.org/SampleCaptures</a></td></tr><tr><td>Xplico Sample captures</td><td><a href="http://wiki.xplico.org/doku.php?id=pcap:pcap">http://wiki.xplico.org/doku.php?id=pcap:pcap</a></td></tr><tr><td>Malware Analysis</td><td></td></tr><tr><td>Contagio</td><td><a href="http://contagiodump.blogspot.com/">http://contagiodump.blogspot.com/</a></td></tr><tr><td>FakeAVs blog</td><td><a href="http://www.fakeavs.com/">http://www.fakeavs.com/</a></td></tr><tr><td>malc0de</td><td><a href="http://malc0de.com/database/">http://malc0de.com/database/</a></td></tr><tr><td>MalShare</td><td><a href="http://malshare.com/">http://malshare.com/</a></td></tr><tr><td>Open Malware / Offensive Computing</td><td><a href="http://openmalware.org/">http://openmalware.org/</a></td></tr><tr><td>theZoo / Malware DB</td><td><a href="http://ytisf.github.io/theZoo/">http://ytisf.github.io/theZoo/</a></td></tr><tr><td>VirusShare.com / VXShare</td><td><a href="http://virusshare.com/">http://virusshare.com/</a></td></tr><tr><td>Virusign</td><td><a href="http://www.virusign.com/">http://www.virusign.com/</a></td></tr><tr><td>VX Heaven</td><td><a href="http://vxheaven.org/">http://vxheaven.org/</a></td></tr><tr><td>VXVault</td><td><a href="http://vxvault.siri-urz.net/">http://vxvault.siri-urz.net</a></td></tr><tr><td>Georgia Tech malrec Page</td><td><a href="http://panda.gtisc.gatech.edu/malrec/">http://panda.gtisc.gatech.edu/malrec/</a></td></tr><tr><td>Malware Traffic</td><td><a href="http://malware-traffic-analysis.net/">http://malware-traffic-analysis.net/</a></td></tr><tr><td>Kernelmode Forum</td><td><a href="http://www.kernelmode.info/">http://www.kernelmode.info</a></td></tr><tr><td>Malware Hub Forum</td><td><a href="http://malwaretips.com/categories/malware-hub.103/">http://malwaretips.com/categories/malware-hub.103/</a></td></tr><tr><td>Public Documents about APTs</td><td><a href="https://github.com/kbandla/APTnotes">https://github.com/kbandla/APTnotes</a></td></tr><tr><td>CLEAN MX realtime database</td><td><a href="http://support.clean-mx.de/clean-mx/viruses.php">http://support.clean-mx.de/clean-mx/viruses.php</a></td></tr><tr><td>Joxean Koret's List</td><td><a href="http://malwareurls.joxeankoret.com/">http://malwareurls.joxeankoret.com</a></td></tr><tr><td>MalwareBlacklist.com</td><td><a href="http://www.malwareblacklist.com/">http://www.malwareblacklist.com</a></td></tr><tr><td>Sucuri Research Labs</td><td><a href="http://labs.sucuri.net/?malware">http://labs.sucuri.net/?malware</a></td></tr><tr><td>Android Sandbox</td><td><a href="http://androidsandbox.net/samples/">http://androidsandbox.net/samples/</a></td></tr><tr><td>Contagio Mobile Malware</td><td><a href="http://contagiominidump.blogspot.com/">http://contagiominidump.blogspot.com/</a></td></tr><tr><td>HoneyDrive</td><td><a href="http://bruteforce.gr/honeydrive">http://bruteforce.gr/honeydrive</a></td></tr><tr><td>maltrieve</td><td><a href="http://maltrieve.org/">http://maltrieve.org/</a></td></tr><tr><td>Online and CTFs</td><td></td></tr><tr><td>Black T-Shirt Cyber Forensics Challenge</td><td><a href="https://cyberforensicschallenge.com/">https://cyberforensicschallenge.com/</a></td></tr><tr><td>DEFCON CTF Archive</td><td><a href="https://www.defcon.org/html/links/dc-ctf.html">https://www.defcon.org/html/links/dc-ctf.html</a></td></tr><tr><td>DFRWS</td><td><a href="http://www.dfrws.org/2013/challenge/index.shtml">http://www.dfrws.org/2013/challenge/index.shtml</a><br><a href="http://www.dfrws.org/2010/challenge/">http://www.dfrws.org/2010/challenge/</a><br><a href="http://www.dfrws.org/2011/challenge/index.shtml">http://www.dfrws.org/2011/challenge/index.shtml</a><br><a href="http://www.dfrws.org/2007/challenge/index.shtml">http://www.dfrws.org/2007/challenge/index.shtml</a><br><a href="http://www.dfrws.org/2006/challenge/">http://www.dfrws.org/2006/challenge/</a><br><a href="http://www.dfrws.org/2005/challenge/">http://www.dfrws.org/2005/challenge/</a></td></tr><tr><td>Digital Forensics Security Treasure Hunt</td><td><a href="http://digitalforensics.securitytreasurehunt.com/">http://digitalforensics.securitytreasurehunt.com/</a></td></tr><tr><td>ENISA CERT Training Material</td><td><a href="https://www.enisa.europa.eu/activities/cert/support/exercise">https://www.enisa.europa.eu/activities/cert/support/exercise</a></td></tr><tr><td>ForensicKB Practicals</td><td><a href="http://www.forensickb.com/2008/01/forensic-practical.html">http://www.forensickb.com/2008/01/forensic-practical.html</a><br><a href="http://www.forensickb.com/2008/01/forensic-practical-2.html">http://www.forensickb.com/2008/01/forensic-practical-2.html</a><br><a href="http://www.forensickb.com/2010/01/forensic-practical-exercise-3.html">http://www.forensickb.com/2010/01/forensic-practical-exercise-3.html</a><br><a href="http://www.forensickb.com/2010/06/forensic-practical-exercise-4.html">http://www.forensickb.com/2010/06/forensic-practical-exercise-4.html</a><br><a href="http://www.forensickb.com/2011/01/simple-forensic-puzzle-1.html">http://www.forensickb.com/2011/01/simple-forensic-puzzle-1.html</a><br><a href="http://www.forensickb.com/2011/02/forensic-puzzle-6.html">http://www.forensickb.com/2011/02/forensic-puzzle-6.html</a></td></tr><tr><td>HackEire CTF</td><td><a href="https://github.com/markofu/hackeire">https://github.com/markofu/hackeire</a></td></tr><tr><td>Honeynet Challenges</td><td><a href="https://www.honeynet.org/challenges">https://www.honeynet.org/challenges</a><br><a href="http://old.honeynet.org/scans/index.html">http://old.honeynet.org/scans/index.html</a></td></tr><tr><td>Jack Crook's DFIR Challenges</td><td><a href="https://docs.google.com/file/d/0B_xsNYzneAhEN2I5ZXpTdW9VMGM">https://docs.google.com/file/d/0B_xsNYzneAhEN2I5ZXpTdW9VMGM</a></td></tr><tr><td>I Smell Packets</td><td><a href="http://ismellpackets.com/">http://ismellpackets.com/</a></td></tr><tr><td>Network Forensics Puzzle Contest</td><td><a href="http://forensicscontest.com/puzzles">http://forensicscontest.com/puzzles</a></td></tr><tr><td>RingZer0 Team</td><td><a href="http://ringzer0team.com/challenges">http://ringzer0team.com/challenges</a></td></tr><tr><td>UMass Trace Repository</td><td><a href="http://traces.cs.umass.edu/">http://traces.cs.umass.edu/</a></td></tr></tbody></table>
