Govdocs1 File Corpus
Simson Garfinkel and contributors · Digital Corpora · 2009
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A corpus of 986,278 real files harvested from US government web servers, distributed as numbered archives on Digital Corpora. The published statistical report (contributed by Forensic Innovations, Inc.) breaks the collection down by type and originating platform — hundreds of thousands of documents, text files, images and hypertext files across Windows, UNIX, DOS and Macintosh origins.
Who it is for, and when
Use it when you need a large, messy, publishable set of real-world files rather than a scenario: testing file-type identification and file carving, exercising signature and format parsers, benchmarking a hashing or deduplication pipeline, and training classifiers. Because it is genuinely heterogeneous — including malformed and legacy formats — it exposes parser failures that a hand-built test set will not.
What it does not cover
It is a bag of files, not evidence: there is no file system, no disk image, no timeline and no scenario, so nothing here supports a recovery, attribution or timeline exercise. The files are real published documents, so any copyright notices inside them still apply.
Go to the source
Open at digitalcorpora.org (opens in a new tab)https://digitalcorpora.org/corpora/file-corpora/govdocs1/
Details
- Type
- Dataset
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Simson Garfinkel and contributors
- Publisher
- Digital Corpora
- Year
- 2009
- Topics
- datasets, file-systems, tool-testing, validation
- Checked at source
Related entries
Garfinkel, Farrell, Roussev and Dinolt's DFRWS 2009 paper, published in Digital Investigation, arguing that digital forensics could not be a science without shared, redistributable test data, and introducing the corpora — including the real-data disk images and the govdocs document set — that the field went on to use.
A NIST repository of documented simulated digital evidence — images and data sets with known ground truth — developed with National Institute of Justice support. Holdings include scenario images (hacking case, data leakage case), Windows registry and Unicode string-search sets, Mac and mobile images, memory images, file carving and deleted-file-recovery sets, and reference/control drives.
A maintained index of populated mobile test images produced by Joshua Hickman and linked from his blog: Android 7 through 14, and iOS 13, 14 (with a macOS Big Sur image), 15, 16 and 17. Most are hosted by Digital Corpora, with one iOS 14 set on MediaFire.
NIST's long-running programme that builds tool specifications, test assertions, test procedures and test data for categories of forensic function — disk imaging, hardware and software write blocking, deleted file recovery, file carving, string searching, media preparation, mobile device and cloud data extraction, Windows registry and SQLite tools — and publishes the resulting test reports with DHS Science and Technology.
Brian Carrier's paper in IJDE 2003, Volume 1, Issue 4, which modelled forensic tools as stacks of abstraction layers — bytes to file system to file to application content — and pointed out that every layer translation introduces potential error that the tool's output hides. Note that the IJDE table of contents prints 'Tool' singular even though the paper is usually cited as 'Tools'.