What you will learn
- Handle digital evidence methodically
- Inspect metadata and logs
- Explain findings with reproducible evidence
Digital Forensics CTF Challenges
Investigate files, metadata, logs, memory artifacts, and network captures to reconstruct events from digital evidence.
Digital Forensics challenges
43 challenges available.
ForensicsLevel 112. Identify File Signatures
Files contain identification information called "magic bytes" at the beginning. Even if the extension is disguised,…
ForensicsLevel 113. Hidden Metadata in Images
Photos and images contain metadata called EXIF. This metadata records shooting date, camera info, GPS coordinates,…
ForensicsLevel 115. Extract Strings from Binary
Binary files (executables, etc.) contain human-readable strings. Passwords, URLs, error messages, and other hints can…
ForensicsLevel 2Find Attack in Apache Logs
Analyze Apache access.log to find traces of SQL injection attacks. Learn log analysis and pattern matching. Provided…
ForensicsLevel 2Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel file to find the flag. Learn how to analyze Office document macros.…
ForensicsLevel 2Hidden PDF Streams
PDF files contain multiple object streams. Find the flag hidden in one of them. Learn to understand PDF internal…
ForensicsLevel 2Find USB History in Windows Registry
Analyze the SYSTEM file to retrieve connected USB device information and the hidden flag. Learn the basics of Windows…
ForensicsLevel 2Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img` and read the hidden secret file from the filesystem to recover the…
ForensicsLevel 2Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
ForensicsLevel 2Identify Intrusion Time from File Timestamps
Analyze timestamps of multiple files to identify when the intrusion occurred and which hidden log is related to it.…
ForensicsLevel 2Find Process in Memory Dump
Analyze the process list recorded in memory.dump and find the flag contained in the suspicious process name. Learn the…
ForensicsLevel 2Recover Deleted Files
Recover deleted text files from the disk image and find the flag. Learn how to use file carving tools to recover…
ForensicsLevel 2Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
ForensicsLevel 3Extract Session Cookies from Chrome
Analyze Chrome history database and Cookie file to retrieve session information for a specific site. Learn browser…
ForensicsLevel 3Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
ForensicsLevel 3Find Deleted File Traces in NTFS $MFT
Analyze `mft_records.txt`, a dump of the NTFS Master File Table, to recover information about deleted files. A…
ForensicsLevel 3Detect Brute-Force Attack in Event Logs
Analyze the authentication log `auth.log` to find traces of a brute-force attack. Aggregate failed logins per source…
ForensicsLevel 3Find Suspicious Network Connections in Memory
Analyze the network-connection record `netstat_dump.txt` to identify the suspicious C&C connection. The single…
ForensicsLevel 3Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
ForensicsLevel 3Recover Deleted SQLite Records
Recover the deleted record from the SQLite database `app.db` to obtain the flag. Deleted rows persist in the freelist,…
ForensicsLevel 3Decompress Multi-Layer Archive
Decompress a file that has been compressed multiple times with different formats (zip, tar, gzip, bzip2). Learn to…
ForensicsLevel 3Decrypt Encrypted Disk
`secret_disk.img` is a genuine LUKS2 container. Brute-force `wordlist.txt` to find the weak passphrase, then decrypt…
ForensicsLevel 3Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
ForensicsLevel 4Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture and analyze the API secret recorded in its Android resources. No real device…