Digital Forensics
Pulling evidence out of files, network captures and disk images, and reading what someone tried to hide.
- Track
- CTF challenges
- Estimated time
- 30 min
- Level
- Intermediate
Before this lesson
Digital forensics challenges in CTF give you a file, a network capture or a disk image and ask you to extract a hidden piece of information: a deleted file, data inside a header, or a password that travelled across the network. The core skill is examining files at the byte level, understanding the structure of different formats, and knowing the tools that read them. The link to the Linux lesson is clear, since most of these tools run on the command line. This lesson introduces the types of forensics challenge and how to approach them step by step.
Labs
A line in the log
SolvedEasyDownload
Find the suspicious line and decode its value to extract the flag.
Enter the labLockedCarving a file from a disk image
SolvedMediumDownload
Carve the buried file by its signature, extract it, and read the flag.
Enter the labLockedReassembly from a capture
SolvedHardDownload
Open the capture and reassemble the UDP payloads by sequence number to extract the flag.
Enter the labLockedRecovery from slack space
SolvedHardDownload
Recover both notes, tell the current from the stale, and read the flag.
Enter the labLocked