Forensics

Digital forensics is investigating what happened. You examine artifacts — memory dumps, disk images, network captures, logs — and reconstruct events or extract hidden data.

In the real world, this is what happens after a breach. In CTFs, it shows up as file analysis, steganography, and memory/network challenges.

Branches

Memory forensics: Analyze a RAM dump. Find running processes, open network connections, encryption keys, credentials, injected code.

Disk forensics: Examine a disk image. Recover deleted files, examine file system metadata, find artifacts left by malware or an attacker.

Network forensics: Analyze packet captures. Reconstruct sessions, find transmitted data, identify malicious traffic patterns.

Steganography: Find data hidden inside files — images, audio, video. Often shows up in CTFs as a separate category.

Core Skills

• File identification — knowing what type of file you are looking at, even when the extension lies
• Hex analysis — reading raw bytes to understand file structure
• Timeline reconstruction — ordering events using timestamps across different artifacts
• Artifact knowledge — knowing where data lives on Windows and Linux systems (registry, event logs, prefetch, browser history, etc.)

Tools

Never Touch the Original

Evidence you modify is evidence you destroyed. Every step below is read-only.

sha256sum disk.img                              # hash it first. Hash it again at the end. They must match.
mkdir /mnt/evidence
sudo mount -o ro,loop disk.img /mnt/evidence    # read-only mount. Nothing you do can write to it.

Then ask each file what it is before you trust its name:

file suspicious.bin
exiftool photo.jpg        # metadata: camera, GPS, timestamps, editing software
binwalk firmware.bin      # files embedded inside other files
stat document.pdf         # access, modify, and change times

Timestamps answer “when”. The three in stat are modify (content changed), change (metadata changed), and access (read). An access time newer than the modify time means someone opened the file after the last edit. References: exiftool, binwalk.

Getting Started

For memory forensics: download a memory sample from the Volatility samples page and practice running plugins against it.

For disk forensics: Digital Corpora has real disk images from training exercises.

For CTF forensics: PicoCTF has approachable forensics challenges. TryHackMe has dedicated forensics rooms.

Real-World Context

Forensics analysts work in incident response, law enforcement, and corporate security. After an attacker is detected, forensics answers: what did they do, how did they get in, and what did they take?

The SANS FOR508 course is the industry standard for advanced forensics, though expensive. The free materials from SANS and their CTF events (DFIR CTFs) are good substitutes.

References

• Volatility documentation
• SANS DFIR blog
• CTF101 — Forensics
• Digital Corpora — forensics datasets