A home forensics lab where only the hardware costs money

A usable home digital forensics lab costs nothing in software and nothing in evidence. Every tool below is free, and every dataset is published specifically so that people can practise on it and write about it. The only money you must spend is on hardware — a machine with enough RAM to run a virtual machine, spare storage for images, and eventually a hardware write blocker. Build the software side first, because it will tell you what hardware you actually need.

We deliberately quote no hardware prices here. Component pricing moves weekly and varies by region, and a figure written today would be wrong by the time you read it. What we can be specific about is which tools do what, which datasets have published ground truth, and which of the free options have licence terms you need to read before you rely on them.

What does a home forensics lab need to be able to do?

Four things, in this order: acquire an image without altering the source, verify that the image is what you acquired, analyse it, and record what you did well enough that someone else could repeat it. Everything else is optional. NIST SP 800-86 sets out the process model — collect, examine, analyse, report — and the SWGDE best practices for computer forensic acquisitions state what the acquisition step should look like. Read both before you install anything, because a lab that produces results you cannot explain is a worse habit than no lab at all.

Which analysis environment should you start with?

Two free, maintained environments cover almost everything.

SIFT Workstation is a free Ubuntu LTS-based virtual machine appliance from SANS bundling more than a hundred open-source IR and forensic tools, pre-configured and dependency-resolved. Plaso, Volatility, The Sleuth Kit and bulk_extractor are present and working together, which saves days of dependency wrangling. Its real value in serious work is reproducibility: naming SIFT and its version pins down a great deal about how an analysis was run. It is an analysis environment, not an acquisition platform — it offers no write blocking as a virtual machine, has no case management or reporting layer, and its tool versions lag upstream, so check the version of anything you cite.

CAINE and Tsurugi Linux are live distributions for the other half of the job. CAINE 14 "Lightstream" is built on Ubuntu 24.04 and locks all block devices read-only by default, with a GUI to unblock deliberately — the most useful safety property either offers, because it makes an accidental write to evidence an explicit act rather than an oversight. Tsurugi ships a LAB analysis edition, a lighter Acquire edition for imaging, and the BENTO portable live-response toolkit.

The honest limit on both: a distribution is a bundle, not a validated instrument. The tools inside carry their own versions and quirks, and you are responsible for knowing which version of which tool produced a result. And software write blocking is a configuration that can be changed or can fail — it is not equivalent to a hardware write blocker for evidentiary purposes.

What hardware do you actually need, and in what order?

• A host with enough RAM to run a VM comfortably alongside your own desktop. Memory analysis and timeline work are the memory-hungry parts; everything else is disk-bound.
• Separate storage for images, kept apart from your working operating system. Disk images are large and you will keep several copies of each at different stages.
• A hardware write blocker, eventually. It is the one purchase that changes what your work is worth, because software blocking is a setting and hardware blocking is a device. Buy it when you start imaging physical media rather than working downloaded images, and validate it — NIST's Federated Testing distributes a hardware write blocking test suite specifically so a lab can produce a documented validation without test-engineering capacity.
• A cheap USB drive and an old laptop you own outright. This is your legitimate practice target for end-to-end acquisition, and it is the only device you should ever image that is not a published dataset.

Nothing on that list needs to be new or fast. The single most common mistake is buying hardware first and discovering that the free tooling would have run on what you already had.

Which free tools do the actual work?

Job	Free tool	The catch
Image and preview on Windows	FTK Imager	Images and previews only; it is not a write blocker, and download is gated behind Exterro's form
Image and verify on Linux	libewf / ewfacquire	Format tools only; Ex01 and vendor metadata support lags the commercial tools
Mount an image as a full disk	Arsenal Image Mounter	Paid — ewfmount is the free alternative but without shadow-copy or boot-to-VM behaviour
File system analysis	The Sleuth Kit and Autopsy	Autopsy is the GUI most people should start with
Windows artefact parsing	Eric Zimmerman's tools and RegRipper	Instruments, not instruction — you must know which artefact answers your question
Event log triage	Hayabusa and Chainsaw	Rule-driven: a quiet result often means logging was never enabled
Timeline building	Plaso / log2timeline into Timesketch	Timesketch parses nothing itself and needs a server deployment
Memory analysis	Volatility 3 and MemProcFS	Both analyse memory; neither acquires it
Unallocated space and fragments	bulk_extractor	Produces features without context; false positives are routine
Network evidence	Wireshark, Zeek and Suricata
Mobile extraction parsing	iLEAPP, ALEAPP, RLEAPP	They parse extractions; they do not acquire them
Data transformation	CyberChef and DB Browser for SQLite
Known-file suppression	NIST NSRL / RDS hash sets	Presence means "known software", never "benign"
Reverse engineering	Ghidra, YARA and YARA-X	A specialism most examiners never need

Two tools deserve a specific warning before you build a workflow around them.

KAPE is the usual fast triage collector, and its licence changed. The project documentation states KAPE is free for government, educational, research and internal company use, and that as of 1 January 2026 it is no longer available for commercial use — meaning third-party networks or paid engagements. That rules it out for most consulting and expert-witness work, which is exactly where many practitioners previously used it. For a home lab learning on your own data it is fine; for your first paid engagement it is not, and Velociraptor is where most people have gone instead.

Autopsy is the right first GUI, and be clear-eyed about what its training costs. The Autopsy Basics and Hands On course does not publish a price on the page we could read, and a widely repeated claim that the eight-hour introductory course is free is not supported by the current page — the eight-hour course appears to be paid, and a $500 processing fee applies to purchase-order or invoice payment for fewer than ten seats. Note also that it assumes you already know forensic fundamentals.

Which datasets can you legally practise on?

This is the part people get wrong, and it is the easiest part to get right, because the field has published a great deal of evidence specifically for this purpose.

• NIST CFReDS — documented simulated evidence with known ground truth, developed with National Institute of Justice support. Scenario images including a hacking case and a data-leakage case, registry and Unicode string-search sets, Mac and mobile images, memory images, file carving and deleted-file-recovery sets, plus reference and control drives. Ground truth is the point: practising on data whose contents you do not know teaches you nothing about whether you were right.
• Digital Corpora — disk images, memory dumps, mobile extractions and packet captures held in Amazon S3 under the AWS Open Data Sponsorship Program. The site states the images, dumps and captures are freely available and may be used without prior authorisation or IRB approval. Read the limit: CC0 covers only the original site content, and copyrighted software inside the images keeps its own terms, so redistributing an image is not automatically clean. The Real Data Corpus of secondhand drives is marked no longer available.
• M57-Patents Scenario — a scripted corporate case covering four weeks of a fictional patent-search company, with daily hard drive images and daily RAM captures for each computer, USB images, inbound and outbound packet captures, and simulated warrants and detective reports. It is the standard teaching case for running an investigation end to end, and the daily images let you practise differencing and cross-machine timelines. The answer keys and hash sets are released only to faculty at accredited institutions, so a self-studying practitioner has no authoritative marking scheme, and the environment is Windows-era 2009.
• Ali Hadi's DFIR challenges — eleven numbered challenges plus memory, unallocated-space and Linux cases, covering alternate data streams, NTFS hidden-file recovery, browser artefacts, Sysinternals abuse, encryption and anti-forensics. Downloads are spread across Archive.org, Mega and GitHub, and challenge 11 is only partly available, so expect to hunt for links.
• Josh Hickman's public mobile test images — populated Android 7 through 14 and iOS 13 through 17 images, no registration required. These are the reference images the mobile community uses to check tool output, and having consecutive OS versions lets you show how an artefact moved between releases. No explicit licence is stated on the page, so treat availability as best-effort.
• Govdocs1 — 986,278 real files harvested from US government web servers. Use it when you need a large, messy, publishable set for file-type identification, carving, signature parsers or hashing pipelines. It is a bag of files: no file system, no disk image, no timeline, no scenario.
• DFRWS forensic challenges — annual research challenges with scenario data and published results in the DFRWS GitHub organisation, Apache-2.0 licensed with SHA256 checksums. The 2023 "Troubled Elevator" set alone supplies ICS traffic, eight PLC external RAM dumps, seven on-chip dumps, a desktop memory dump, CCTV footage, a network diagram and the equipment manual. There is no guided walkthrough and the recent sets assume you can write your own parsers.

For graded practice with answers, CyberDefenders and Blue Team Labs Online both work from downloadable artefacts. BTLO's free tier gives you challenges as downloadable artefacts, with the scored investigation environment behind PRO at £15 per month, £40.50 for three months, £76.50 for six or £144 per year. Part of the CyberDefenders catalogue is marked PREMIUM and the site does not publish prices on the challenge listing.

What should you never point your lab at?

Other people's devices. Not your partner's phone, not a relative's laptop, not a machine from your employer's estate, and not a drive bought secondhand on the assumption that whatever is on it is yours now. The legal exposure is real and the forensic value is nil, because you have no ground truth to check your answer against.

The line drawn by the Computer Fraud and Abuse Act is narrower than people assume but it is not a free pass. In Van Buren v. United States the Supreme Court held that a person exceeds authorised access only by reaching files, folders or databases that are off limits — a gates-up-or-down inquiry rather than a question of motive. That means the presence of an authentication barrier is the thing that matters, which is precisely why imaging a device you were never given credentials for sits on the wrong side of the line. The Stored Communications Act adds a separate exposure for accounts: in Sewell v. Bernardin the Second Circuit treated unauthorised access to separate accounts as separately accruing claims, each with its own clock.

None of that arises if you work published datasets, which is the whole reason the datasets exist.

How do you know your lab is producing correct results?

Validate against something. This is the single habit that separates a hobby setup from a lab whose output could be defended.

• Run the same question through two independently written tools and compare. Volatility 3 and MemProcFS on the same memory image; iLEAPP against a commercial mobile suite's output. Two differently written parsers agreeing is a materially stronger position than one vendor's output.
• Read the published test reports before trusting a tool. NIST's CFTT programme publishes a methodology for testing forensic software along with specifications, procedures, criteria and test reports, and Federated Testing packages the methodology as bootable ISOs and a portable Windows build so you can run it yourself. A self-run result is not a NIST endorsement, and the suites do not cover memory, timeline reconstruction or most analysis tools.
• Read the SWGDE minimum requirements for testing tools once, so you know what a validation is supposed to establish.

What to read while you build it

Two books do more for a home lab than any course at this stage. Practical Forensic Imaging covers securing digital evidence with Linux tools, which is exactly the free stack above. File System Forensic Analysis is the one place to go deep once — understanding a single file system at byte level is what separates someone who reads tool output from someone who can say why the tool is right.

Then keep the free references to hand: Eric Zimmerman's tools ship alongside the SANS DFIR posters and cheat sheets, which compress the artefact knowledge expensive courses spend days on into pages you can pin up. The ForensicArtifacts repository is the machine-readable answer to "where does this artefact live" for something you do not handle often — definitions in YAML, not data, and carrying no interpretation of what a value means.

Build all of that, work the M57 case end to end, and you will have done more genuinely transferable work than a single $8,780 course would have given you. The programs directory is where to look when you are ready to spend money — and it will also tell you, per entry, what the money does not buy.