Downloading the sample files
Before we begin our DFIR file recovery and data carving activities, I thought it would be a good idea to first have all sample files downloaded, which will allow us to jump straight into the specifics of using each tool without the process being interrupted.
We will be using the following sites, which generously offer free datasets and acquisitions to the public. A special thank you to all that have compiled and invested their time and resources to make these datasets available to us:
- Digital Forensics Tool Testing Images: https://dftt.sourceforge.net/
- Computer Forensic Reference DataSets (CFReDS): https://cfreds.nist.gov/
- Digital Corpora: https://digitalcorpora.org/
- Foremost sample file: https://cfreds-archive.nist.gov/FileCarving/Images/L0_Documents.dd.bz2
- Scalpel: http://prdownloads.sourceforge.net/dftt/11-carve-fat.zip?download
- Bulk Extractor: https://digitalcorpora.s3.amazonaws.com/corpora/drives/nps-2010-emails/nps-2010...