Creating Realistic Corpora for Security and Forensic Education
Kam Woods, Christopher A. Lee, Simson Garfinkel, David Dittrich, Adam F. Russell, Kris Kearton · 2011
We present work on the design, implementation, distribution, and use of realistic forensic datasets to support digital forensic and security education. We describe in particular the "M57-Patents" scenario, a multi-modal corpus consisting of hard drive images, RAM images, network captures, and images from other devices typically found in forensics investigations such as USB drives and cellphones. Corpus creation has been performed as part of a scripted scenario; subsequently it is less "noisy" than real-world data but retains the complexity necessary to support a wide variety of forensic education activites. Realistic forensic corpora allow direct comoparison of approaches and tools across classrooms and institutions, reduce the time required to prepare useful educational materials, and eliminate concerns of exposing students to privacy-sensitive or illegal digital materials. The "M57-Patents" corpus can be freely distributed without rights-restrictive materials, and is available with disk images packaged in both open (Advanced Forensic Format) and commercial (EnCase) formats.