Disk, memory & binary forensics
Recover artifacts and extract indicators with forensic and reverse-engineering GUIs.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Autopsy · Ghidra · Volatility · Wireshark
- Class GUI-need label
HY· Hybrid
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.05.01.04-T01 Carve recoverable images from a disk image
Original instruction
In Autopsy, add fixtures/for/case01.E01 as a data source and run file carving. Report how many recoverable JPEG/PNG files were carved and the sha256 of the largest one. Tag the carved files in the case.
- Platforms
win· Windowslin· Linux- Applications
- Autopsy
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json count matches the lab ground truth; the reported sha256 matches the largest carved image; the carved set is tagged in the Autopsy case db. GUI carving is graded via the case; a photorec CLI route is allowed to cross-check but tags must exist in the case.
Proposed partial credit
40% correct carved count; 30% correct largest-file hash; 30% files tagged in case
R03.05.01.04-T02 Build a file-activity timeline from a disk image
Original instruction
From fixtures/for/case01.E01, generate a timeline and identify the 3 files created or modified within the 10-minute window around the incident time in incident.txt. Export those timeline rows and tag the files.
- Platforms
win· Windowslin· Linux- Applications
- Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP10· Annotations- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The 3 reported file paths match the lab key for the incident window; exported timeline.csv rows carry correct MACB times; files tagged in the case. A fls/mactime CLI cross-check is allowed; final answer graded on the exported rows.
Proposed partial credit
50% three correct files in window; 30% correct MACB times; 20% exported+tagged
R03.05.01.04-T03 Recover deleted browser history
Original instruction
The user cleared browsing history on fixtures/for/laptop.E01. Recover the deleted SQLite history records and report the last 5 visited URLs with timestamps. Save them to history.csv and add a case note.
- Platforms
win· Windows- Applications
- Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
HY· Hybrid- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
history.csv lists the 5 correct URLs+timestamps from the recovered records matching lab ground truth (order by time). Graded on the exported CSV; sqlite recovery via CLI is permitted as a cross-check.
Proposed partial credit
60% five correct URLs; 20% correct timestamps; 20% case note recorded
R03.05.01.04-T04 Extract malware config in Ghidra to a schema
Original instruction
In Ghidra, analyze the inert lab sample fixtures/for/sample.bin (static only, sandboxed). Locate the embedded configuration (C2 host, port, campaign id) and write malware_config.json per fixtures/for/schema.json. Annotate the config-decoding function in Ghidra.
- Platforms
win· Windowslin· Linux- Applications
- Ghidra
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP10· Annotations- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
malware_config.json validates against the schema and its field values match the lab ground truth; the decoding function is renamed/commented in the Ghidra project. Static analysis only; sample never executed.
Proposed partial credit
30% config region located; 40% correct field values in schema; 30% function annotated in Ghidra
R03.05.01.04-T05 Annotate a decryption routine in Ghidra
Original instruction
The lab binary fixtures/for/stringhide.bin decrypts its strings at runtime. In Ghidra, identify the decryption routine, recover the key/algorithm statically, label the function and key variable, and submit the decrypted banner string to answer.txt.
- Platforms
win· Windowslin· Linux- Applications
- Ghidra
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.txt equals the known decrypted banner; the decryption function and key variable are renamed in the Ghidra project; a decode script (if used) reproduces the string. Static only.
Proposed partial credit
40% routine located+labeled; 30% key/algorithm recovered; 30% correct decrypted string
R03.05.01.04-T06 Find the suspicious process in a memory dump
Original instruction
Using Volatility on fixtures/for/mem.raw (synthetic Windows dump), list processes and identify the one that is masquerading (wrong parent/path) as a system process. Report its PID, name, and the anomaly to answer.json.
- Platforms
win· Windowslin· Linux- Applications
- Volatility
- Interfaces
term· Terminaldesk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json PID and name match the lab's injected/masquerading process and the anomaly matches the key (e.g. unexpected parent or path). Graded on the reported fields.
Proposed partial credit
40% correct PID; 30% correct name; 30% correct anomaly described
R03.05.01.04-T07 Recover the malicious command line and parent
Original instruction
From fixtures/for/mem.raw, extract the full command line of the suspicious process found earlier and its parent process chain up to the shell/explorer root. Write the chain to chain.json in order.
- Platforms
win· Windowslin· Linux- Applications
- Volatility
- Interfaces
term· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
chain.json command line matches the lab value exactly and the parent chain order matches ground truth. Graded on the reported chain.
Proposed partial credit
50% exact command line; 50% correct ordered parent chain
R03.05.01.04-T08 Dump a process and extract its config from memory
Original instruction
From fixtures/for/mem.raw, dump the suspicious process's memory, carve the in-memory configuration blob, decode it, and write the recovered C2 settings to mem_config.json. Note the virtual address range you dumped.
- Platforms
win· Windowslin· Linux- Applications
- Volatility · Ghidra
- Interfaces
term· Terminaldesk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
mem_config.json field values match the lab ground truth; the noted address range overlaps the config region; dump hash reproducible. Graded on reported config + range.
Proposed partial credit
30% process dumped from correct range; 30% config blob carved; 40% decoded settings correct
R03.05.01.04-T09 Identify the exfil session and export objects
Original instruction
In Wireshark, open fixtures/for/exfil.pcap and find the HTTP session that uploads a file to an external host. Report the client IP, server host, and uploaded filename, and export the transferred object. Save findings to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json client IP, server host, and filename match the lab key; the exported object's sha256 matches the expected file. tshark cross-check allowed; graded on reported fields + exported object hash.
Proposed partial credit
40% correct session identified; 30% client/host/filename; 30% object exported (hash matches)
R03.05.01.04-T10 Reconstruct a transferred file from a capture
Original instruction
fixtures/for/transfer.pcap contains a file sent over FTP-DATA split across many segments. Reassemble the stream, reconstruct the original file, and report its name and sha256 to answer.json. Save the reconstructed file to out/.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The reconstructed file in out/ has the sha256 recorded in answer.json and matches the lab's expected file; filename correct. Follow-stream GUI or tshark export both acceptable; graded on file hash.
Proposed partial credit
50% stream reassembled; 30% correct file reconstructed (hash); 20% correct name
R03.05.01.04-T11 Find a file hidden by renamed extension
Original instruction
On fixtures/for/usb.E01, one file has a mismatched extension (header says it is an archive, name says .txt). Use Autopsy's file-type vs extension mismatch view to find it, report its path, and tag it.
- Platforms
win· Windowslin· Linux- Applications
- Autopsy
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Reported path matches the lab's planted mismatch file and the file is tagged in the case. Graded on the case tag + reported path.
Proposed partial credit
60% correct file identified; 40% tagged in case
R03.05.01.04-T12 Recover persistence from a registry hive
Original instruction
From the exported hives in fixtures/for/hives/, recover autostart persistence: the Run-key entries and the most recently connected USB device. Report entries and the USB serial/first-connect time to answer.json.
- Platforms
win· Windows- Applications
- Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json Run-key entries match the lab key and the USB device serial + first-connect time match ground truth. RegRipper CLI or a GUI hive viewer both acceptable; graded on reported fields.
Proposed partial credit
40% Run-key persistence entries; 40% USB device serial; 20% first-connect time
R03.05.01.04-T13 Recover command history from memory
Original instruction
From fixtures/for/mem.raw, recover the console command history for the attacker session and the clipboard contents at capture time. Write the ordered command list to cmds.txt and clipboard text to clip.txt.
- Platforms
win· Windowslin· Linux- Applications
- Volatility
- Interfaces
term· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
cmds.txt matches the lab's recorded command history in order and clip.txt matches the captured clipboard. Graded on the two files.
Proposed partial credit
60% command history recovered+ordered; 40% clipboard recovered
R03.05.01.04-T14 Correlate disk and memory evidence
Original instruction
Given fixtures/for/host.E01 and fixtures/for/mem.raw from the same host, link the suspicious process in memory to its on-disk executable and its creation event. Produce correlate.json with the PID, on-disk path+hash, and the disk creation timestamp.
- Platforms
win· Windowslin· Linux- Applications
- Volatility · Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP12· Answer/decision- Conditions
long· Long-horizonmultiapp· Multi-app- Proposed difficulty
- 5 / 5
Proposed verifier
correlate.json PID, on-disk path, file hash, and creation timestamp all match lab ground truth and the hash matches the dumped image. Graded on reported fields across both sources.
Proposed partial credit
30% memory process identified; 30% on-disk binary located (hash); 20% creation time; 20% consistent linkage
R03.05.01.04-T15 Recover a hiding algorithm and decode config
Original instruction
fixtures/for/packed.bin hides its config behind a custom multi-byte XOR+rotate scheme. In Ghidra, recover the exact transform statically, implement decode.py, decode the config, and write it to decoded_config.json. Annotate the transform in Ghidra.
- Platforms
win· Windowslin· Linux- Applications
- Ghidra
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP06· Code/engineering- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
decode.py reproduces the lab's reference decode on a sample; decoded_config.json matches ground truth; the transform function is labeled in Ghidra. Static only.
Proposed partial credit
40% transform recovered; 30% decode.py correct on sample; 30% config decoded
R03.05.01.04-T16 Extract image metadata indicators
Original instruction
From the carved images in fixtures/for/photos/, extract EXIF metadata and report which images carry GPS coordinates and camera serials. Write indicators.csv (filename, has_gps, lat, lon, camera_serial).
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Autopsy
- Interfaces
term· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandsvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
indicators.csv rows match the lab ground truth for which files have GPS and the coordinate/serial values (within tolerance). Graded on the CSV.
Proposed partial credit
40% correct has_gps flags; 40% coordinates; 20% camera serials
R03.05.01.04-T17 Extract email artifacts from a disk image
Original instruction
fixtures/for/mail.E01 contains a mailbox export. Recover the phishing email that started the incident: report sender, subject, attachment name, and its sha256. Save to email.json and tag the artifact in the case.
- Platforms
win· Windows- Applications
- Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
email.json sender/subject/attachment name match the lab key and the attachment hash matches; artifact tagged in case. Graded on reported fields + tag.
Proposed partial credit
30% email located+tagged; 40% sender/subject/attachment; 30% attachment hash
R03.05.01.04-T18 List dump processes via Volatility CLI (control pair of T06)
Original instruction
Control pair of T06: using only the Volatility command line (no GUI), run pslist/psscan over fixtures/for/mem.raw and write the full process table (PID, PPID, name, create time) to pslist.csv. Flag the row that psscan reveals but pslist hides.
- Platforms
lin· Linux- Applications
- Volatility
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP02· Records/table- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
pslist.csv matches the lab's process table and the flagged hidden/unlinked process matches the one psscan-only reveals. Graded on the CSV; pure-CLI route, contrast with the T06 GUI/hybrid approach.
Proposed partial credit
50% complete process table; 30% correct fields; 20% hidden process flagged
R03.05.01.04-T19 Prove execution from Prefetch evidence
Original instruction
From fixtures/for/win.E01, parse Windows Prefetch to prove the suspicious binary ran: report its run count, last run time, and the volume it ran from. Write to exec.json and build a short execution timeline note.
- Platforms
win· Windows- Applications
- Autopsy
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
exec.json run count, last run time, and source volume match the lab ground truth. Prefetch GUI viewer or CLI parser acceptable; graded on reported fields.
Proposed partial credit
40% correct binary's prefetch found; 30% run count+last run; 30% source volume + note
R03.05.01.04-T20 Produce a forensic IOC report from image and dump
Original instruction
Given fixtures/for/host.E01 and fixtures/for/mem.raw, investigate the intrusion end to end and deliver iocs.json (per fixtures/for/ioc_schema.json: hashes, C2, persistence, accounts) plus report.md with a timeline and findings. Tag all supporting artifacts in the Autopsy case.
- Platforms
win· Windowslin· Linux- Applications
- Autopsy · Volatility · Ghidra
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
HY· Hybrid- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentcode· Code & commands- Work product
WP01· Document- Conditions
long· Long-horizonmultiapp· Multi-app- Proposed difficulty
- 5 / 5
Proposed verifier
iocs.json validates against the schema and its entries match the lab ground truth (>=80% of fields); report.md timeline ordering is correct (rubric for narrative); case contains the supporting tags. Graded on the IOC JSON + tags + rubric.
Proposed partial credit
40% IOC fields correct; 30% correct timeline; 30% artifacts tagged + report sections present
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.