Digital Corpora's Gov Docs

Digital Corpora, operating under a grant from the National Science Foundation, has posted electronic files here, which can be used to test forensic and electronic discovery techniques.

A thousand separate directories, each with a thousand files, can be downloaded for review. A set of more than 100,000 jpegs is available. The metadata for the files includes search terms; search engines used to find the files; and SHA1 hash values. The files were collected from the United States government. Malware has been deliberately left in the data. The full set includes nearly one million files in a wide variety of formats. One possible drawback is that a very small number of the files (only about 2000) are email files.

Digital Corpora has also posted images made of cell phones, and disk images. PII data has been removed from the disk images. Forensics students can practice with disk images in the EnCase format. These contain information on how data was taken from a fictional businessperson's laptop, and the challenge is to find out if the data was taken by a malicious actor, or intentionally disclosed by the employee.

Global Relay

Financial regulations require many businesses to retain archives of business communications.  Global Relay is widely used by financial firms to comply with these requirements.   22 of the 25 biggest banks in the world use Global Relaay. 

When conducting electronic discovery inquire as to whether or not a client uses its services to manage email, instant messages, Bloomberg messages, and social media DMs.  

Its apps for smartphones may allow businesspeople to access message archives on the go. 

.mig files

Windows 7 comes with a built-in tool which assists a user to back-up his or her data and settings to another computer. Easy Transfer will save all data on a hard drive to a .mig migration file, that can then be accessed on a new Windows computer. Encryption is available for the file. Unfortunately Easy Transfer is not available on the Windows 10 operating system, which uses PC Mover instead.

The .mig file condenses a PC's data. Be sure to look for such files when conducting a forensic review of a computer. They can be valuable archives of a user's data from a particular point in time.