ctf-forensics

You can recover hidden flags from memory dumps and disk images by applying digital forensics techniques like Volatility-based memory analysis, filesystem-aware carving, and extracting embedded objects based on magic bytes. This Skill provides repeatable decoding steps to locate likely flag-containing regions.

Decrypting PCAP traffic and decoding covert channels involves parsing captured network data and applying decryption when keys are available. This process reconstructs peripheral and device streams, turning messy network evidence into decoded artifacts for flag recovery.

Yes, you can extract embedded files from disk images using a filesystem-based agent with bash and Python 3. The workflow supports identifying file types by magic bytes, mounting or carving disk images, and recovering deleted or orphaned data.

To start CTF triage, ask for a forensic plan for the attached evidence file, specifying whether it is a disk image, memory dump, or PCAP. The workflow will provide the shortest command-and-decision sequence to extract likely flag artifacts.

Steganography analysis is supported for recovering CTF flags from signal artifacts and embedded files. The Skill applies digital forensics techniques to decode common covert and encoding channels hidden within various evidence types.