forensics ctf hints
spoiler-free hints for forensics challenges.
steganography · PCAP analysis · memory forensics · file carving · metadata · disk images
what forensics ctf challenges look like
forensics challenges give you files — images, PCAPs, memory dumps, disk images, archives, logs. the goal is to find hidden data or reconstruct what happened. always start with file, strings, and xxd to understand what you're looking at before reaching for specialized tools.
common forensics challenge types
- steganography — LSBdata hidden in the least significant bits of image pixels. use zsteg (PNG) or stegsolve to extract. try steghide for password-protected stego.
- steganography — file in filea file appended inside another. binwalk detects embedded files. foremost carves them out. check file headers with xxd.
- PCAP analysisopen in Wireshark. filter by protocol (http, ftp, dns). follow TCP streams to read conversations. export objects to recover transferred files.
- memory forensicsuse Volatility to analyze memory dumps. list processes (pslist), dump process memory, find injected code (malfind), recover files from memory.
- metadataexiftool extracts metadata from images, documents, and other files. GPS coordinates, author info, creation dates, and comments often contain the flag.
- file carvingbinwalk -e to extract embedded files. foremost to carve by file signature. testdisk / photorec for disk image recovery.
- encoded data in filesstrings | grep -i flag. base64-encoded sections. look for QR codes, barcodes, or text hidden in pixels of images.
useful tools
Wireshark for PCAP · Volatility for memory dumps · binwalk / foremost for file carving · exiftool for metadata · zsteg / steghide / stegsolve for steganography · CyberChef for decoding · file + xxd + strings for first recon on any file.
faq
where should I start with a forensics file?+
run file and strings first, then binwalk to spot embedded or appended files, and exiftool for metadata. the giveaway is often in plain sight before you reach for heavier tooling — a mislabeled extension or a flag sitting in the strings output.
which tool matches which artifact?+
images: zsteg or stegsolve for stego, exiftool for metadata. PCAPs: Wireshark follow-stream and export objects. memory dumps: Volatility plugins (pslist, malfind, dumpfiles). disk images: autopsy or foremost/photorec for carving.
how do I extract data hidden in an image?+
check LSB steganography with zsteg or stegsolve, look for an appended archive or file with binwalk, and read EXIF with exiftool. also try changing the file extension and re-opening — a PNG that is really a ZIP is a common trick.