Anti-ForensicsRendering Digital Investigations Irrelevant
Reference Library · Read • Investigate • Corroborate

Downloads

Use versioned evidence logs, validation worksheets, and review checklists with file checksums.

Materially reviewed · Curated reference

Working records you can adapt

These blank, site-authored worksheets help make source scope, handling, and uncertainty visible. They contain no evidence, case examples, or third-party binaries. Use required organizational forms where applicable.

Evidence and transfer log

text/csv · 272 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 3455596d86b6acc0495c6109af7831ee1bfe29904e549713bb2daa8692f3679c

Timeline corroboration worksheet

text/csv · 209 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 537a37a89763dcf7979970ac8b75cdaffdbc32ea82f5111c0bf6b1f4cee7f7d2

Validation study worksheet

text/markdown · 906 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 5fab4f5ae22671237536ba4a96bcd60f022de0096fc76e221975f334259e3564

Acquisition verification checklist

text/markdown · 1044 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: f900d045cac3f5d250d4be744f85e6aa9576765d5a9aca3f8f82834e3923b198

Forensic report review checklist

text/markdown · 965 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 7386ea46be96a6c9beeab5a16adf4e968042f28ddcab1da1f5fcb8e15ed9a3d7

Collection scope and coverage register

text/csv · 214 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 7e4e7be8ad83e469b438fd2626e283ef9e7cd2baeced120bc2c43cb9e8d4f469

Artifact corroboration matrix

text/csv · 163 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 53498f01f0283452f876e3099dd6ef998094b405b440d9da29eae54da93931e3

Tool disagreement register

text/csv · 179 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 3279cf068821d8774ae2bf2288a55d465a5a0ae9ce57d912c938ac1b6b2c9a3d

Cloud export verification log

text/csv · 234 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 13301e3d3ead6114914e5072e541c1b1e4368ed005ad0f0714db6092f19e1b26

Live-response change accounting log

text/csv · 198 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: aa23d22acfbd496ab5041ceb7265e37d5eeebb4187df667587203636fc50b889

Metadata consistency worksheet

text/csv · 185 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: f85e8381af50a4ee8dcea3852dac8f106bc7ce69e692624af3d48eb2185b81e9

Parser validation case register

text/csv · 191 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: ba6c1a28a7d17ad872c08bdcb4c9454c801f7fbf574d6fdf885983064997c326

Source claim and inference register

text/csv · 206 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 2ff34ae40df11a333e303c71dfdf5eec36d019ddcd5441ca886f18959cbe1aee

Incident evidence handoff template

text/markdown · 853 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: fb61ac1aef3e97ea8fdf592d3fd80018f8fa229dff5a21aae7038a76c8b93e46

Negative evidence review checklist

text/markdown · 728 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 0d717542f3d8e080637822b29fa3566caf374fb98172f7dd7d555ca533b7fe49

Synthetic-media evidence intake form

text/markdown · 803 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 1ebeb79539d75b749888d8a203317ae907ee4de20dca8533ab2436f8bee2f087

Packet-capture context checklist

text/markdown · 665 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 0b7ef72151d128b695fa1f02fdbe2964996b25a1baf209a8340852cd2a568646

Reproducible research bundle manifest

text/csv · 167 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 2265cbd979232c0d0c1a118fe24457e3d4748753637aaeb86198f2f18d3a8334

Material correction record

text/markdown · 398 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: 24876aac5040f44f5c1350173db3f4b0177dd18eb35fa466c14866eeae170521

Cloud identity and session mapping worksheet

text/csv · 236 bytes · Version 1.0 · 2026-10-22 · CC0-1.0

SHA-256: d5e30dd7cac907cd57cedf286332abbbf454bf7d09e4b564ad09386ae220b7d9

What a checksum establishes

Compare the SHA-256 digest of a downloaded file with the value above to check that file against this release. This is the checksum of this site’s export. It is not an upstream tool hash, a malware scan, or proof that a completed form is accurate.

Download the machine-readable file manifest · Use the acquisition verification guide