Disk Images

June 6th, 2010

The NPS Corpus

The NPS Corpus is a set of disk images that have been created for testing computer forensic tools. These images are free of non-public Personally Identifiable Information (PII) and are approved for release to the general public. The NPS-created data in these images is public domain and free of any copyright restriction; the images may contain some copyrighted data that was made freely available by the copyright holder. These copyrights, where known, are noted in the files themselves. Currently the following images in the NPS corpus have been released:

  • nps-2009-canon2 — A set of images taken on with a Canon digital camera that can be used to test basic file recovery, fragmented file recovery, and file carving.
  • nps-2009-casper-rw — An ext3 file system from a bootable USB token that had an installation of Ubuntu 8.10. The operating system was used to browse several US Government websites.
  • nps-2009-hfsjtest1 — A test image of a journaled HFS system in which the data from a previous version of a file can only be recovered from the HFS journal
  • nps-2009-ntfs1 — A test image of an NTFS file system including unfragmented and highly fragmented files stored in raw, compressed, and encrypted directories. The decryption key is provided.
  • nps-2009-ubnist1 — The FAT32 file system from which the nps-2009-capser-rw disk image was extracted.
  • nps-2009-domexusers — This is a disk image of a Windows XP SP3 system that has two users, domexuser1 and domexuser2, who communicate with a third user (domexuser3) via IM and email. Two versions of this disk image will be provided:
    • nps-2009-realistic – The full system, distributed as an encrypted disk image.
    • nps-2009-realistic-redacted – The full system with the Microsoft Windows executables redacted so that they cannot be executed.

The Real Data Corpus

Currently there are over 750 images available for use by bona fide researchers. The images are divided into two categories:

US Persons Disk Image Corpus
Contains images from disks purchased within the United States.

Non-US Persons Disk Image Corpus
Contains images from disks purchased outside the United States. Please contact
Simson Garfinkel
if you are interested in using the Real Data Corpus.

Comments are closed.