What you will learn
- Handle digital evidence methodically
- Inspect metadata and logs
- Explain findings with reproducible evidence
Digital Forensics CTF Challenges
Investigate files, metadata, logs, memory artifacts, and network captures to reconstruct events from digital evidence.
Digital Forensics challenges
43 challenges available.
Forensics Level 4 Detect Unauthorized Access in CloudTrail Logs
Analyze AWS CloudTrail logs to detect unauthorized IAM access and data exfiltration. Learn cloud forensics. Provided…
Forensics Level 4 Extract Secrets from Docker Image Layers
The startup-generated `image/` directory is a `docker save`-style image layer layout. Analyze its `layer.tar` files…
Forensics Level 4 Decrypt TLS-Encrypted HTTPS Traffic
Analyze a safe TLS-forensics fixture. traffic.pcap is a text representation of one TLS application-data capture and…
Forensics Level 4 Extract Malware Payload from Memory
Analyze the recovered memory-string record `memstrings.txt` and reconstruct the obfuscated second-stage payload.…
Forensics Level 4 Detect Hidden Kernel Module in Memory
Compare `modules_list.txt` and `sysfs_modules.txt`, two reconstructed views of Linux kernel modules, to identify the…
Forensics Level 4 Decode Multi-Stage Steganography
Follow the three-stage data trail hidden in `cover.png` and `notes.txt`: decode the PNG pixel-LSB message, the Base64…
Forensics Level 4 Recover Fragmented JPEG File
Analyze the fragments and `.meta` sidecars under `fragments/` to reconstruct a fragmented JPEG. Determine the order…
Forensics Level 4 Recover Damaged RAID5 Array
Reconstruct a three-disk RAID5 scenario as a safe file-level parity fixture. No block device, mdadm, or loop device is…
Forensics Level 4 Reconstruct Attack Scenario from Multiple Logs
Correlate `web.log`, `auth.log`, and `db.log` by session ID to reconstruct the intrusion from the web attack through…
Forensics Level 5 Reconstruct Full APT Attack Stages
Correlate `edr_process.log`, `proxy_http.log`, `dns_queries.log`, and `dlp_transfer.log` on their shared campaign ID…
Forensics Level 5 Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Match a…
Forensics Level 5 Extract Message Hidden in Bitcoin Transaction
Analyze a Bitcoin OP_RETURN using a safe offline transaction fixture. transaction.json is a recorded artefact that…
Forensics Level 5 Extract Secret Key from IoT Device Firmware
Learn IoT firmware extraction using a safe tar-formatted rootfs fixture. firmware.bin is not a real device image.…
Forensics Level 5 Extract VM Information from Hypervisor Memory
Analyze KVM hypervisor guest state using a safe text VMCS/guest-memory fixture. Without starting or acquiring a VM,…
Forensics Level 5 Detect Process Hollowing Attack
Compare `process_list.txt` with `image_regions.txt` to detect process hollowing. The target process has a PRIVATE, RWX…
Forensics Level 5 Detect Tampered Timestamps
Analyze the NTFS-like timeline in `mft_timeline.csv` and compare each file's SI and FN timestamps. The physically…
Forensics Level 5 Decrypt Encrypted iOS Backup
Perform encrypted-iOS-backup password verification with a safe iTunes metadata fixture. No real iPhone or backup is…
Forensics Level 5 Create Memory Profile for Unknown Linux Kernel
Perform custom Linux-kernel memory-profile matching with a safe static fixture. Match the BUILD_ID records in vmlinux,…
Forensics Level 5 Decode Custom Protocol C&C Communication
Analyze the endpoint beacon record `beacon.log` and decode the covert channel hidden among decoy traffic.…