DSET Forensics Benchmark
Operation Nightshade
Operation Nightshade: a seized workstation image of a threat actor. The actor dumped credentials, moved laterally, exfiltrated data and then wiped or forged its traces. The single 64 MiB image mounts with real tools; but the surface files mislead and the real evidence is buried behind layered anti forensics. Answer the 180 questions.
What Is in the Image
Evidence Categories
Submit Your Answers
Answer the 180 questions below, or download the JSON template, fill it and paste it. The same scoring runs via the API. Soundness, the resistance to planted false evidence, is measured alongside recall.
Paste answer-template JSON (optional)
About This Case
Operation Nightshade is the DFB master case: a single, fully synthetic forensic disk image that consolidates twenty one evidence disciplines into one investigation. It is built to defeat automated triage and require genuine human or agent analysis. The file system mounts cleanly, so surface tools see innocuous files, while the incriminating evidence lives in deleted clusters, an embedded memory dump, encrypted containers whose keys leak across artifacts, a polyglot file, and scattered fragments that must be reassembled from several sources.