Digital forensics basics

Digital forensics examines files, devices, logs, memory, and network data. In a CTF, the organizer usually gives you a copy of the evidence. Your goal is to recover information and explain how the evidence supports the answer.

Preserve the original

Keep the supplied file unchanged. Make a working copy and analyze the copy. Calculate a cryptographic hash of the original and record it. If the hash changes later, the file changed.

Use clear filenames and record where the evidence came from. This habit makes your work repeatable even when a competition does not require formal evidence handling.

Identify the real file type

A filename extension is a label. The file content determines the format. Inspect the first bytes, known as the file signature or magic bytes. Compare the signature with documentation for the suspected format.

If a file does not open, do not immediately assume that it is damaged. It can have an incorrect extension, additional data, a missing header, or an embedded file.

Use a layered process

1. Record the filename, size, hash, and supplied context.
2. Identify the file type from its content.
3. Extract readable strings and inspect metadata.
4. Open the file with a tool made for that format.
5. Look for embedded objects, archives, alternate streams, or appended data.
6. Create a timeline when several timestamps or events are relevant.
7. Record every transformation that you apply.

Metadata is evidence, not truth

Metadata can include creation time, software name, device information, coordinates, account names, or document properties. A user or program can change metadata. Use it as one source of evidence and compare it with other facts.

Network captures

A packet capture records network traffic. Start with the protocols, endpoints, and time range. Follow one conversation before you inspect every packet. Look for transferred files, cleartext data, unusual requests, and changes in behavior.

Do not assume that every unusual packet is malicious. Explain how the packet connects to the challenge goal.

Memory and disk images

Memory can contain running processes, connections, command history, encryption material, and data that was not saved to disk. A disk image can contain files, deleted records, partitions, and filesystem metadata.

These evidence types can be large. Start with the challenge question and collect the minimum evidence needed to answer it.

Write the evidence chain

Your writeup must show how one observation led to the next test. Include hashes, paths, timestamps, commands, and important output. Explain the meaning of the evidence instead of publishing a large output dump.