CTF Handbook

Forensics Basics ​

Forensics challenges ask you to reconstruct what happened from disk images, memory dumps, logs and files.

In progress

This category is being written. Planned topics:

  • Disk images and file systems
  • Memory forensics with Volatility
  • Windows event logs and the registry
  • Browser, email and chat artifacts
  • File recovery and data carving
  • Network traffic and PCAP analysis
  • Timeline analysis and evidence correlation

Study tips ​

  1. Learn the basics of file systems and operating systems.
  2. Get familiar with Autopsy, Volatility, Wireshark and foremost.
  3. Always work on a copy of the evidence and keep the original untouched.