What you will learn
- Handle digital evidence methodically
- Inspect metadata and logs
- Explain findings with reproducible evidence
Digital Forensics CTF Challenges
Investigate files, metadata, logs, memory artifacts, and network captures to reconstruct events from digital evidence.
Digital Forensics challenges
43 challenges available.
Forensics Level 1 12. Identify File Signatures
Files contain identification information called "magic bytes" at the beginning. Even if the extension is disguised,…
Forensics Level 1 13. Hidden Metadata in Images
Photos and images contain metadata called EXIF. This metadata records shooting date, camera info, GPS coordinates,…
Forensics Level 1 15. Extract Strings from Binary
Binary files (executables, etc.) contain human-readable strings. Passwords, URLs, error messages, and other hints can…
Forensics Level 2 Find Attack in Apache Logs
Analyze Apache access.log to find traces of SQL injection attacks. Learn log analysis and pattern matching. Provided…
Forensics Level 2 Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel file to find the flag. Learn how to analyze Office document macros.…
Forensics Level 2 Hidden PDF Streams
PDF files contain multiple object streams. Find the flag hidden in one of them. Learn to understand PDF internal…
Forensics Level 2 Find USB History in Windows Registry
Analyze the SYSTEM file to retrieve connected USB device information and the hidden flag. Learn the basics of Windows…
Forensics Level 2 Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img` and read the hidden secret file from the filesystem to recover the…
Forensics Level 2 Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
Forensics Level 2 Identify Intrusion Time from File Timestamps
Analyze timestamps of multiple files to identify when the intrusion occurred and which hidden log is related to it.…
Forensics Level 2 Find Process in Memory Dump
Analyze the process list recorded in memory.dump and find the flag contained in the suspicious process name. Learn the…
Forensics Level 2 Recover Deleted Files
Recover deleted text files from the disk image and find the flag. Learn how to use file carving tools to recover…
Forensics Level 2 Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
Forensics Level 3 Extract Session Cookies from Chrome
Analyze Chrome history database and Cookie file to retrieve session information for a specific site. Learn browser…
Forensics Level 3 Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
Forensics Level 3 Find Deleted File Traces in NTFS $MFT
Analyze `mft_records.txt`, a dump of the NTFS Master File Table, to recover information about deleted files. A…
Forensics Level 3 Detect Brute-Force Attack in Event Logs
Analyze the authentication log `auth.log` to find traces of a brute-force attack. Aggregate failed logins per source…
Forensics Level 3 Find Suspicious Network Connections in Memory
Analyze the network-connection record `netstat_dump.txt` to identify the suspicious C&C connection. The single…
Forensics Level 3 Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
Forensics Level 3 Recover Deleted SQLite Records
Recover the deleted record from the SQLite database `app.db` to obtain the flag. Deleted rows persist in the freelist,…
Forensics Level 3 Decompress Multi-Layer Archive
Decompress a file that has been compressed multiple times with different formats (zip, tar, gzip, bzip2). Learn to…
Forensics Level 3 Decrypt Encrypted Disk
`secret_disk.img` is a genuine LUKS2 container. Brute-force `wordlist.txt` to find the weak passphrase, then decrypt…
Forensics Level 3 Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
Forensics Level 4 Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture and analyze the API secret recorded in its Android resources. No real device…