Aegis-7 Forensics Lab
LAB_STATUS:Secure

Digital Twin Simulation: Unit 402

Live telemetry mapping of the smart home forensic environment including BLE, Zigbee, and MQTT node propagation.

COORD_REF: 40.7128° N, 74.0060° W
Digital twin smart home map — interactive
ACTIVE_NODES7 / 28
SUSPECT3
ACQUIRING2
Live Bus
[SYS] Twin viewport linked to evidence bus
[NET] 28 nodes enumerated
Node Inspector
Hover the map to scan coordinates. Click a node to inspect. Double-click to acquire its image and open the case.

Evidence Ticker

14:22:01[ACQ] Node_882 (Nest Cam) stream mirrored
14:21:44[TRC] BLE Handshake: Galaxy Watch → Hub
14:21:30[FLG] Metadata mismatch on MQTT Broker
14:20:55[SYS] Disk Image 40% complete: SSD_V2
14:20:12[SEC] Lab perimeter door SEALED
Urgent Alert
UNAUTHORIZED HANDSHAKE DETECTED ON ZIGBEE CHANNEL 11. NODE: SM-BULB-01

Forensic_Zones

Total Stations: 05

Classified_Case_Files

Live_Investigation_Workstation

Full DFIR sim: 5 cases, real shell with history + tab-complete, queryable SQLite, packet analyzer, MITRE ATT&CK mapping, IOC export, persistent XP across sessions.

0 XP
CASE FZ-01
Intermediate250 XP

Smartwatch Homicide Timeline

Victim wore an Apple Watch S9. Acquire NAND, verify hash, parse HealthDomain, recover GPS + heart-rate, and prove the suspect was on-site at 22:04.

TARGET: Apple Watch S9 — IMEI 3554-118-994

Investigator Guide

1 / 8
Step 1 · Acquire
Image the watch NAND first. Nothing can be done before acquisition.
$ acquire watch

Objectives

0/5
  • Acquire watch image
  • Verify image integrity
  • Extract GPS track
  • Extract heart-rate spike
  • Correlate with door-unlock

Collected Artifacts

No artifacts yet.

aegis$

Chain_of_Custody

Object IDTimestampActionHash (SHA-256)
DEVICE-0914:15:22IMAGING8f2a...c011
LOG-X713:42:01VERIFIED4d91...a44b
V-DUMP-0112:10:55SEALED1e02...f910
WATCH-IMG-0411:33:18ACQUIRED3b7c...d221
ROUTER-PCAP-A10:05:41PROCESSING9a1f...e302

Evidence_Vault

Storage Capacity
4.2 PB Allocated
INTEGRITYSHA-256 OK
CASES1,024
ARTIFACTS8,391
PENDING REVIEW47

Quick Actions

Visual Forensic Timeline

Correlated event reconstruction across 12 distinct IoT nodes.

22:04:12 - DOOR_UNLOCKSmart Lock V3
22:04:15 - LIGHTS_ONPhilips Hue
22:05:01 - ALEXA_REQEcho Dot
22:05:44 - WATCH_SYNCApple Watch S9
22:06:18 - CAM_MOTIONRing Doorbell
22:07:33 - THERM_ADJUSTNest Thermostat
22:08:12 - TV_POWERSamsung Smart TV
22:09:05 - FRIDGE_EVTSmart Fridge

Active_Protocol_Monitors

5 Protocols
CAPTURING
Wi-Fi 6E
Packets: 4,291/s
MONITORING
Zigbee
Packets: 120/s
SCANNING
Bluetooth / BLE
Packets: 85/s
INTERCEPTING
MQTT
Packets: 340/s
STANDBY
Z-Wave
Packets: 0/s