Practise forensics on evidence you are allowed to touch

You do not need anyone's phone to learn digital forensics. The field publishes disk images, memory dumps, mobile extractions, packet captures and whole scripted scenarios specifically so that people can practise on them and write about them — with documented ground truth, so you can check whether your answer was right. Practising on a relative's laptop or a secondhand drive gives you no ground truth and real legal exposure. The free material is both safer and pedagogically better, which is an unusually easy decision.

Why is practising on someone else's device a bad idea even when it feels harmless?

Two reasons, and the forensic one is the one people underrate.

You cannot check your answer. The entire value of a practice image is that someone documented what is in it. If you carve a deleted file from a friend's old drive you have no way of knowing whether you found everything, missed half of it, or misinterpreted what you found. NIST CFReDS exists precisely because a dataset with known ground truth tells you whether your method worked, and an undocumented device cannot.

The legal exposure is not theoretical. The Computer Fraud and Abuse Act was read narrowly in Van Buren v. United States, where the Supreme Court held that a person exceeds authorised access only by reaching files, folders or databases that are off limits to them — a gates-up-or-down inquiry rather than a question of motive. That narrowing helps insiders who misused data they were entitled to reach. It does nothing for someone who acquires a device or an account they had no permission to reach at all, because there the gate was down.

Accounts carry a separate exposure under the Stored Communications Act. In Sewell v. Bernardin the Second Circuit held that unauthorised access to separate accounts gives rise to separately accruing claims, each running from discovery of that violation — so an intrusion into two accounts is two claims, not one episode. And the line between in-transit and at-rest acquisition decides which statute applies at all: Konop v. Hawaiian Airlines fixed the rule that interception under the Wiretap Act requires acquisition contemporaneous with transmission, which is why a real-time capture and a server-side copy of the same message are analysed under different laws with different penalties.

What about data that is just sitting on the public web?

This is the question that trips up people building OSINT or collection practice, and the answer is more nuanced than either camp claims.

hiQ Labs v. LinkedIn is the leading authority. On remand after Van Buren, the Ninth Circuit again affirmed a preliminary injunction against LinkedIn blocking a scraper of publicly available member profiles, reading Van Buren's gates framing to imply that the CFAA presupposes some authorisation gate — and where a profile is public, there is no gate to pass. The practical test that emerged is: ask whether the data sits behind an authentication barrier.

Three limits on how far that carries you. The posture was a preliminary injunction, so the questions were held to be serious rather than resolved. The court expressly noted that other remedies may remain available to site operators — trespass to chattels, copyright, contract. And a terms-of-use prohibition is not an access control: Snow v. DirecTV turned the Stored Communications Act's protection into a factual question about system configuration, meaning anyone asserting a claim over a private forum or portal has to describe the access controls concretely.

One more trap worth knowing, because it catches lawyers as often as examiners: a civil subpoena to a provider is a poor route to an opponent's email. In Theofel v. Farey-Jones access obtained through a patently overbroad subpoena was "without authorization" because consent procured by deceit is no consent — serve one that is invalid on its face and the requester can become the defendant.

Which datasets are published for exactly this purpose?

These are the ones with real provenance, and each entry below includes the licence or availability caveat you need to read before you redistribute anything.

NIST CFReDS — documented simulated digital evidence with known ground truth, developed with National Institute of Justice support. Holdings include scenario images (a hacking case, a data-leakage case), Windows registry and Unicode string-search sets, Mac and mobile images, memory images, file carving and deleted-file-recovery sets, and reference and control drives. Use it for tool validation, proficiency testing and training. The honest limits: these are constructed data sets, not real casework, so they will not reproduce the scale, messiness or encryption of a live exhibit; NIST states the portal is under development and may be reorganised; and most sets are explicitly not the Federated Testing data, so do not substitute one for the other.

Digital Corpora — the default answer to "where do I get evidence I am allowed to publish about?" Disk images, memory dumps, mobile extractions, packet captures and file corpora held in Amazon S3 under the AWS Open Data Sponsorship Program. The site states the disk images, memory dumps and packet captures are freely available and may be used without prior authorisation or IRB approval, and places original site content, metadata, scenario data and teacher guides under CC0 because they were produced by US government employees in the course of their duties. Read the limit carefully: CC0 covers only the original site content. Copyrighted software and third-party material inside the images keep their own terms, so redistributing an image is not automatically clean. The Real Data Corpus of secondhand drives — the site's one collection of genuine third-party personal data — is marked no longer available and cannot be obtained. Papers using the data are expected to cite Garfinkel, Farrell, Roussev and Dinolt, "Bringing Science to Digital Forensics with Standardized Forensic Corpora".

M57-Patents Scenario — a scripted corporate case covering the first four weeks of a fictional patent-search company, from 13 November to 12 December 2009. It ships daily hard drive images and daily RAM captures for each computer, USB drive images, inbound and outbound packet captures, final-day images of every system, and simulated case paperwork including detective reports, warrants and affidavits. This is the standard teaching case for running a whole investigation end to end, and the daily images let you practise differencing and cross-machine timelines. Two limits: the answer keys, hash sets and scenario emails are encrypted and released only to faculty at accredited institutions, so a self-studying practitioner has no authoritative marking scheme; and the environment is Windows-era 2009 with no mobile, cloud or modern endpoint telemetry.

Ali Hadi's DFIR challenges — eleven numbered challenges plus additional memory forensics, unallocated-space and Linux cases, covering a breached web server with both disk image and memory dump, Windows policy violation, alternate data streams, NTFS hidden-file recovery, browser artefacts, Sysinternals abuse, encryption, and anti-forensics and data hiding. Several were built for university courses and conference workshops, so the scenarios are tight and the artefact you are meant to find is deliberately placed. Downloads are spread across Archive.org, Mega and GitHub rather than one maintained host, and challenge 11 is listed as only partly available.

Josh Hickman's public mobile test images — populated Android 7 through 14 and iOS 13 through 17, most hosted by Digital Corpora, no password or registration required. These are the reference images the mobile community uses to check tool output, because each is a real device populated with known activity across common apps. Having consecutive OS versions lets you show how an artefact moved between releases, which is often the question in a mobile dispute. The page states no explicit licence or terms and the author asks to be told about broken links, so treat availability as best-effort.

Govdocs1 — 986,278 real files harvested from US government web servers, distributed as numbered archives. Use it for file-type identification, carving, signature and format parsers, and hashing or deduplication pipelines; because it is genuinely heterogeneous, including malformed and legacy formats, it exposes parser failures a hand-built test set will not. It is a bag of files: no file system, no disk image, no timeline, no scenario. The files are real published documents, so any copyright notices inside them still apply.

DFRWS forensic challenges — the annual research challenges, with scenario data, documentation and published results kept in the DFRWS GitHub organisation, Apache-2.0 licensed with SHA256 checksums and large files split into compressed segments. Each challenge deliberately targets something the field cannot yet do well. The 2023 "Troubled Elevator" set supplies ICS traffic in one pcapng, eight PLC external RAM dumps, seven PLC on-chip dumps, a desktop memory dump, CCTV footage, a network diagram and the elevator programming manual — the kind of evidence mix you cannot otherwise obtain legally. There is no guided walkthrough, the recent sets assume you can write your own parsers for embedded memory, and several repositories have not been touched since 2021-2024.

NSRL / RDS hash sets — not a practice case but the thing that makes practice cases tractable, by suppressing known operating-system and application files so your keyword work lands on user-created data. Distributed under a stated NIST redistribution policy. Presence means "known software", never "benign"; absence means "not in the library", never "suspicious". Record which release you used, because the published sets and formats change between releases.

Which challenge platforms give you graded feedback?

Datasets tell you what happened if you already know how to look. Challenge platforms tell you whether you found the right thing.

• CyberDefenders — scenario investigations grouped as endpoint forensics, network forensics, malware analysis, cloud forensics, threat hunting, detection engineering and threat intelligence. You download the artefacts, work them with your own tools, and the questions tell you whether you found the right thing. The cloud and detection-engineering tracks cover ground the older public corpora do not. Part of the catalogue is marked PREMIUM and the site does not publish prices on the challenge listing. The question-and-answer format rewards finding a specific string and teaches nothing about scoping, reporting or defending an opinion — which is a real limitation, not a quibble.
• Blue Team Labs Online — challenges are downloadable artefacts (memory dumps, phishing emails, packet captures, logs) you can work offline with your own tooling; investigations run in hosted lab instances. The site lists 272 investigations for paid members, with PRO published at £15 for one month, £40.50 for three, £76.50 for six and £144 annually. The free tier gives you challenges only, and the platform states it is aimed at people who already have some experience with security tooling.
• TryHackMe's free tier — the lowest possible barrier to starting, with nothing to install. Heavy guidance and hints make it genuinely suitable for someone with no background, which most forensics material is not. The same guidance means you can complete a path without ever having been stuck, which is where the learning is, and it produces no credential an employer will weigh. Premium was shown at €16.99 per month, or €10.50 monthly billed annually, on the page we read.
• Antisyphon's pay-what-you-can classes — a genuine sliding scale starting at $0.00 for live instruction from working practitioners. Read the tiers: under $295 excludes cyber-range access, and the deeper DFIR course is separately priced at $575 on demand and $725 to $1,850 live.
• Cyber5W free DFIR courses and OpenSecurityTraining2 — free structured material where most platforms charge.

If you want one graded credential out of this practice rather than a scoreboard, Certified CyberDefender examines a 48-hour practical across network, disk and memory forensics, perimeter defence and threat hunting — vendor-neutral and genuinely hands-on, though CyberDefenders publishes neither its price nor its renewal terms on the pages we could read.

What does a legitimate end-to-end practice plan look like?

Twelve weeks, nothing paid, and it produces work you can describe in an interview.

1. Weeks 1-2 — method before tools. Read the ACPO Good Practice Guide, NIST SP 800-86 and the SWGDE best practices for computer forensic acquisitions. All free. Write down, in your own words, what a defensible acquisition record contains.
2. Weeks 3-4 — one image, checked. Install Autopsy and work a CFReDS scenario image. Because the ground truth is published, score yourself honestly.
3. Weeks 5-6 — go deep once. Read the relevant chapters of File System Forensic Analysis and repeat the same image with The Sleuth Kit at the command line. Reconcile any difference between what Autopsy told you and what TSK told you; the reconciliation is the lesson.
4. Weeks 7-9 — a whole case. Work M57-Patents end to end. Build a timeline with Plaso, review it in Timesketch, parse Windows artefacts with Eric Zimmerman's tools, and analyse one of the daily RAM captures with Volatility 3.
5. Weeks 10-11 — write it up. Produce a report against the UK Forensic Science Regulator's expert report content guidance and the ENFSI evaluative reporting guideline. State the method, the findings, and the limits of the findings. This is the step everyone skips and the one employers notice.
6. Week 12 — get graded. Work two CyberDefenders or Blue Team Labs Online challenges under time pressure and find out how you perform when the clock is running.

Run the whole thing inside SIFT Workstation, which removes the install problem and — more importantly — means you can name the environment and version when you describe the work later.

Can you publish your write-ups?

Yes, and you should, with two cautions.

Publishing analysis of a public dataset is exactly what the datasets are for. Digital Corpora's terms explicitly anticipate it, and the DFRWS repositories are Apache-2.0 licensed. That is the difference between a portfolio you can show and one you cannot: a write-up of a friend's hard drive is not something you can ever put your name to.

The cautions are that redistribution is not the same as analysis — CC0 on Digital Corpora's own content does not launder the copyrighted software inside an image, and Govdocs1's files carry their own notices — and that a challenge-platform walkthrough often breaches the platform's rules. Write up the public corpora, not the graded challenges.

What if someone offers you a real device to practise on?

Decline, and say why. The offer is usually well meant — an employer handing you a returned laptop, a family member curious what is recoverable, a friend who wants a deleted photo back. In each case you are working without authority you can document, without ground truth, and often without the ability to say afterwards what you did and did not access.

The one legitimate exception is a device you own outright, bought new or already in your possession, that you populate yourself. That is a genuinely useful exercise — you know the ground truth because you created it — and it is the only physical media a self-directed learner needs. Everything else is already published, already documented, and already free in our reference library and the programs directory.