ctf-forensics

To analyze a memory dump, this skill locates forensic artifacts by extracting and correlating Windows and Linux traces to build a coherent timeline. It identifies actionable insights across memory, disk images, and network captures for incident response.

Reconstructing an incident timeline from a disk image and USN journal involves cross-referencing forensic artifacts to establish chronological sequences. This skill correlates registry data, event logs, and USN journal entries to build a coherent narrative.

Yes, you can extract Windows registry data and SAM files during forensics analysis. The skill discovers and analyzes Windows artifacts, including registry data, SAM, and event logs, to locate initial forensic artifacts.

Yes, this approach works with both Windows and Linux forensics artifacts. It discovers and cross-references traces across both operating systems, including registry data, event logs, and browser history, to locate relevant forensic artifacts.

To parse PCAP network captures for CTF forensics challenges, the skill analyzes network traffic data to locate forensic artifacts. It processes PCAP files alongside disk images and memory dumps to cross-reference findings and build a cohesive timeline.

Cross-referencing event logs with disk images helps locate forensic artifacts by linking disparate system traces into a single narrative. This correlation across registry data, USN journals, and network captures builds coherent timelines for incident response.