> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/forensic-exercises.md).

# Forensic Exercises

![](/files/zceQwzdIlJ9yGG08sDv7)

### Chapters

* [Disk Forensics](/cas-cybersecurity/forensic-exercises/disk-forensics.md)
* [Windows Forensics](/cas-cybersecurity/forensic-exercises/windows-forensics.md)
* [Memory Forensics](/cas-cybersecurity/forensic-exercises/memory-forensics.md)
* [Image Forensics](/cas-cybersecurity/forensic-exercises/image-forensics.md)
* [Browser Forensics](/cas-cybersecurity/forensic-exercises/browser-forensics.md)

### Exercises

* [Mail Header Analysis](/cas-cybersecurity/forensic-exercises/mail-header-analysis.md)
* [Timestomping Exercise](/cas-cybersecurity/forensic-exercises/timestomping-exercise.md)

### Other Exercises that contain Forensic content

* [tcp dump analysis from ftp session](/cas-cybersecurity/malware-analysis/yara/tcp-dump-analysis.md) 
* [Memorydump analysis with volatility and yara](/cas-cybersecurity/malware-analysis/yara/memory-dump-analysis.md)