What you will learn
- Handle digital evidence methodically
- Inspect metadata and logs
- Explain findings with reproducible evidence
Digital Forensics CTF Challenges
Investigate files, metadata, logs, memory artifacts, and network captures to reconstruct events from digital evidence.
Digital Forensics challenges
43 challenges available.
ForensicsLevel 4Detect Unauthorized Access in CloudTrail Logs
Analyze AWS CloudTrail logs to detect unauthorized IAM access and data exfiltration. Learn cloud forensics. Provided…
ForensicsLevel 4Extract Secrets from Docker Image Layers
The startup-generated `image/` directory is a `docker save`-style image layer layout. Analyze its `layer.tar` files…
ForensicsLevel 4Decrypt TLS-Encrypted HTTPS Traffic
Analyze a safe TLS-forensics fixture. traffic.pcap is a text representation of one TLS application-data capture and…
ForensicsLevel 4Extract Malware Payload from Memory
Analyze the recovered memory-string record `memstrings.txt` and reconstruct the obfuscated second-stage payload.…
ForensicsLevel 4Detect Hidden Kernel Module in Memory
Compare `modules_list.txt` and `sysfs_modules.txt`, two reconstructed views of Linux kernel modules, to identify the…
ForensicsLevel 4Decode Multi-Stage Steganography
Follow the three-stage data trail hidden in `cover.png` and `notes.txt`: decode the PNG pixel-LSB message, the Base64…
ForensicsLevel 4Recover Fragmented JPEG File
Analyze the fragments and `.meta` sidecars under `fragments/` to reconstruct a fragmented JPEG. Determine the order…
ForensicsLevel 4Recover Damaged RAID5 Array
Reconstruct a three-disk RAID5 scenario as a safe file-level parity fixture. No block device, mdadm, or loop device is…
ForensicsLevel 4Reconstruct Attack Scenario from Multiple Logs
Correlate `web.log`, `auth.log`, and `db.log` by session ID to reconstruct the intrusion from the web attack through…
ForensicsLevel 5Reconstruct Full APT Attack Stages
Correlate `edr_process.log`, `proxy_http.log`, `dns_queries.log`, and `dlp_transfer.log` on their shared campaign ID…
ForensicsLevel 5Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Match a…
ForensicsLevel 5Extract Message Hidden in Bitcoin Transaction
Analyze a Bitcoin OP_RETURN using a safe offline transaction fixture. transaction.json is a recorded artefact that…
ForensicsLevel 5Extract Secret Key from IoT Device Firmware
Learn IoT firmware extraction using a safe tar-formatted rootfs fixture. firmware.bin is not a real device image.…
ForensicsLevel 5Extract VM Information from Hypervisor Memory
Analyze KVM hypervisor guest state using a safe text VMCS/guest-memory fixture. Without starting or acquiring a VM,…
ForensicsLevel 5Detect Process Hollowing Attack
Compare `process_list.txt` with `image_regions.txt` to detect process hollowing. The target process has a PRIVATE, RWX…
ForensicsLevel 5Detect Tampered Timestamps
Analyze the NTFS-like timeline in `mft_timeline.csv` and compare each file's SI and FN timestamps. The physically…
ForensicsLevel 5Decrypt Encrypted iOS Backup
Perform encrypted-iOS-backup password verification with a safe iTunes metadata fixture. No real iPhone or backup is…
ForensicsLevel 5Create Memory Profile for Unknown Linux Kernel
Perform custom Linux-kernel memory-profile matching with a safe static fixture. Match the BUILD_ID records in vmlinux,…
ForensicsLevel 5Decode Custom Protocol C&C Communication
Analyze the endpoint beacon record `beacon.log` and decode the covert channel hidden among decoy traffic.…