Digital forensics lab

DexForensics.

Blue-team investigations
in the browser.

Guided disk, memory, and EVTX fixtures with MFT-style timelines, IOC workspace, and YARA-style rules — all client-side. Lab v1.0.7.

Score 0MITRE 0/6
Training questStage 1/5

Mission start

Pick your story

Each card is a fake investigation (like a level). Choose one — you’ll get a pretend hard drive listing, fake memory snippets, and log lines to read. No real company data.

💡 New to this? Start with “Ransomware prep” — it has the most clues.

← → keys

Simulated training only — nothing uploaded; runs in your browser.

01 /

Guided case

02 /

Chain of custody

Integrity Verification

Session Logging

Progress

0Target 3
03 /

Timeline (MFT · EVTX · memory)

Synthetic timestamps for training — correlate FILE_SYSTEM with Security and strings.

TimeSrcSummary
2026-04-18 08:50:02MFT
C:\Users\Public\Documents\stage.ps1
FILE_CREATE · USN_REASON_FILE_CREATE
2026-04-18 08:55:12EVTX
Security · EID 4625
Failed logon. Account: admin_test Reason: Unknown user or bad password. Source: 198.51.100.22
2026-04-18 09:10:18MFT
C:\ProgramData\svchelper\beacon.dll
FILE_MODIFY · MFT $STANDARD_INFO altered
2026-04-18 09:12:03EVTX
Security · EID 4624
Successful logon. Account: backup_svc Type: 3 Workstation: JUMP-ADM Source: 10.20.30.40
2026-04-18 09:12:41EVTX
Microsoft-Windows-WinRM · EID 91
WSMan CreateShell completed on Win32_Process resource.
2026-04-18 09:12:44MEM
0x1f4a8c20
... contoso\backup_svc @ CONTOSO-WS01 ... WinRM Client session to JUMP-ADM.contoso.lab ...
2026-04-18 09:13:01MEM
0x2b901040
... lsass.exe ... dbghelp.dll loaded from C:\ProgramData\svchelper\ ... (simulated)
2026-04-18 09:13:22MEM
0x33c0ffe0
... mimikatz-style banner (redacted) ... sekurlsa::logonpasswords ... training artifact
2026-04-18 09:14:18EVTX
System · EID 7045
Service installed. Name: PSEXESVC Path: %SystemRoot%\PSEXESVC.exe
2026-04-18 09:14:20MFT
C:\Windows\Prefetch\PSEXESVC.EXE-ABCDEF12.pf
FILE_CREATE
2026-04-18 09:14:25MEM
0x4012aa00
... \\127.0.0.1\PIPE\PSEXESVC ... PSEXESVC ...
2026-04-18 09:18:02EVTX
Security · EID 4698
Scheduled task created. Name: \Microsoft\Windows\DiskCleanup\SilentCleanup\Maintenance Author: CONTOSO\jdoe
04 /

Evidence lab

Preview & IOCs

Select a file in the tree.
05 /

Artifact Intelligence

Select an entry in the Evidence Lab to see artifact intelligence.
Volatility cheat sheet (this scenario)
  • windows.pslist.PsList
    vol.py -f mem.dmp windows.pslist.PsList
    Baseline running processes; look for orphaned rundll32 without a desktop parent.
  • windows.malfind.Malfind
    vol.py -f mem.dmp windows.malfind.Malfind
    In a real lab, injected code sections often pair with your simulated LSASS-adjacent strings.
  • windows.registry.hivelist
    vol.py -f mem.dmp windows.registry.hivelist
    Maps to offline NTUSER.DAT review for Run keys — same story as your hive excerpt.
06 /

YARA & IOC Workspace

Pinned: None
07 /

Reports

Verification & session log + 3 findings required.