ctf-forensics

Automate digital forensics workflows by applying deterministic scanning across disk images, memory dumps, and PCAPs. This Skill orchestrates Volatility 3, binwalk, and exiftool to extract artifacts and correlate cross-cues to locate hidden flags.

Yes, you can analyze memory dumps and parse Windows registry hives using Volatility 3. The workflow extracts registry artifacts and searches memory strings to uncover flags hidden within system processes or configurations.

Extract hidden data from PCAP files and disk images by scanning for file signatures with binwalk. The workflow extracts embedded artifacts from network captures and disk images, searching PDFs and image metadata for flag patterns.

Yes, you need Python 3 and Bash to execute these steganography and artifact recovery workflows. A filesystem-based agent and internet access are also required for installing open-source tools like Volatility 3 and exiftool.

Cross-artifact correlation locates flags by linking evidence across disk images, network captures, and event logs. It systematically connects extracted PDFs, image metadata, and memory strings to pinpoint hidden data relationships.

Yes, this Skill supports PDF analysis and steganography detection for CTFs. It applies systematic workflows using exiftool and binwalk to parse image metadata and extract hidden payloads from embedded files.