DSET Forensics Benchmark · soundness odaklı
The Digital Forensics Benchmark
The reference arena where forensic software, AI agents and human examiners test their tools against advanced, reproducible cases. The hardest part of forensics is not finding evidence, it is recovering the truth without being deceived. DFB measures exactly that.
Why DFB
Soundness, not just recall
Planted false evidence is everywhere. A tool that reports it as real is penalised hard. We measure truth and resistance to deception together.
Stratified antiforensics
From clean (AF0) to multi technique chained adversaries (AF4): hidden volumes, timestamp manipulation, journal wiping, fileless memory, all in one case.
Cross artifact correlation
A key in RAM unlocks a container on disk, referenced in a capture, whose timestamp refutes a disk timestamp forgery. Single artifact tools collapse.
How it works
- Download the single 64 MiB forensic image. It mounts with real tools.
- Analyse with your own tool, AI agent or team: carve, decrypt, correlate across artifacts.
- Submit your 180 answers to the scoring API or the in browser form.
- Score instantly: recall, soundness and tier, then your leaderboard rank.
Disciplines
Disk and File System
Deleted and partial recovery, carving, VSS, unallocated depth
Memory (RAM)
Hidden process, fileless malware, encryption keys leaked in RAM
Antiforensics (AF0..AF4)
Wiping, timestamp manipulation, hidden volumes, planted false trails, anti tool
Cryptanalysis
Classical, hash, AES, RSA, JWT, OTP and unbreakable edge cases
Windows and Logs
Event logs, pass the hash traces, forged logs, registry persistence