ctf-forensics

Identify forensic artifacts across disk images, memory dumps, logs, and PCAPs.

1|Updated Feb 6, 2026

Search Tags:#blockchain #ctf #forensics #memory-dump #disk-image #event-logs #network-captures

Ready to run

npx skills add https://github.com/ramzxy/CTF --skill ctf-forensics

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ctf-forensics
Source: https://github.com/ramzxy/CTF/tree/main/.agents/skills/ctf-forensics
Command: npx skills add https://github.com/ramzxy/CTF --skill ctf-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a consolidated reference for digital forensics and blockchain analysis in Capture The Flag (CTF) challenges, enabling rapid identification and contextualization of artifacts across multiple data sources.

Core Features & Use Cases

Cross-source artifact analysis: Analyze disk images, memory dumps, Windows event logs, PCAPs, and blockchain traces to discover evidence and flags.
Guided workflows: Offers step-by-step procedures and quick-reference commands to reproduce investigations and validate findings.
Forensic techniques reference: Provides common techniques, tools, and data formats used in forensics to accelerate training and challenges.

Quick Start

Scan a disk image for embedded artifacts: binwalk image.dd
Inspect memory dumps and event logs for indicators: vol3 -f memory.dmp windows.info
Review network captures for flag-like indicators: tshark -r capture.pcap -Y "http" -T json

Frequently Asked Questions about ctf-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze a memory dump for forensic artifacts in a CTF?▼

To analyze a memory dump, you inspect it using tools like Volatility 3 to extract process lists, registry hives, and event logs. This structured investigation helps identify hidden flags and indicators of compromise across the captured memory state.

What is the best way to examine network captures for hidden flags?▼

Examining network captures involves using tools like tshark to filter PCAP files for specific protocols such as HTTP. You review the extracted network traffic data to identify flag-like indicators and trace communication patterns.

How do I scan a disk image to find embedded files during a forensics investigation?▼

Scanning a disk image involves using tools like binwalk to identify and extract embedded artifacts. This cross-source analysis enables rapid discovery of evidence and hidden flags within the raw disk data structure.

Can I trace cryptocurrency transactions using standard forensics workflows?▼

Yes, you can trace cryptocurrency transactions by applying structured investigation workflows to blockchain artifacts. This process contextualizes transaction data to reveal evidence and flags hidden within the blockchain trace.

Does this forensics workflow support cross-referencing Windows event logs with disk image analysis?▼

Yes, the workflow supports cross-source artifact analysis, allowing you to review Windows event logs alongside disk images and memory dumps. This consolidated reference accelerates evidence discovery and validates findings across multiple data sources.