skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

ctf-forensics

Triage and analyze disk images, memory dumps, PCAP captures, and stego media.

1.6k|234|Updated Dec 7, 2019
Search Tags:#memory#ctf#steganography#forensics#volatility#disk#pcap
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-forensics-wgpsec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-forensics
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/ctf/ctf-forensics
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-forensics-wgpsec

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Provide a structured, repeatable methodology to triage and analyze CTF-style digital forensics artifacts so investigators can quickly find flags and evidence inside disk images, memory dumps, network captures, and steganographic media. It consolidates common tools and decision trees into an operational workflow that guides whether to mount, carve, dump, or decode each artifact type.

Core Features & Use Cases

  • Multi-format Triage: Recognizes .dd/.img/.vmdk disk images, .vmem/.raw memory dumps, .pcap/.pcapng network captures, EVTX logs, and common stego image/audio formats and maps each to an analysis path.
  • Memory & Disk Workflows: Volatility3 plugin guidance, mft/fls/icat usage, photorec/foremost carving, LUKS/master-key detection, VMDK sparse parsing, RAID5 XOR reconstruction, and APFS/BTRFS snapshot recovery.
  • Network & Stego Extraction: tshark/Wireshark object export, TCP/HTTP stream reconstruction, DNS/ICMP covert-channel decoding, binwalk/zsteg/steghide guidance, and audio spectrogram / SSTV techniques.
  • Validation & Hard Cases: Techniques for encrypted ransomware key recovery (seeded PRNG, OFB checks), minidump and VMware snapshot handling, and hints for when to pivot from automated tooling to raw byte-level analysis.

Quick Start

Analyze memory.dmp and image.dd to locate and extract flags using memory forensics, file carving, and PCAP object extraction.

Frequently Asked Questions about ctf-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a memory dump for CTF flags using Volatility3?▼

Memory dump analysis applies stepwise Volatility3 plugins to extract processes, network connections, and injected code from .vmem or memory.dmp files. This structured workflow reveals hidden artifacts and CTF flags.

What is the best way to carve files from a disk image in forensics challenges?▼

Disk image carving uses Sleuth Kit mft/fls/icat commands and photorec/foremost to extract deleted files from .dd or .vmdk images. It supports parsing sparse VMDKs and reconstructing RAID5 or APFS/BTRFS filesystems.

How do I extract hidden data from steganography files?▼

Steganography extraction applies binwalk, zsteg, and steghide techniques to embedded image and audio media. It also covers audio spectrogram and SSTV decoding to reveal hidden flags within forensic artifacts.

Can I reconstruct TCP streams and export objects from pcap network captures?▼

Yes, you can reconstruct TCP and HTTP streams and export objects from .pcap files using tshark and Wireshark. The workflow also includes decoding DNS and ICMP covert channels to find hidden CTF flags.

How do I recover forensic evidence from encrypted disks or ransomware cases?▼

Encrypted disk recovery involves detecting LUKS and master keys, handling minidumps, and checking OFB modes and seeded PRNG for ransomware keys. It guides pivoting from automated tools to raw byte-level analysis.

Related Skills

Explore More Education & Research Skills→
a398275770-ctrla398275770-ctrl

ctf-forensics

Analyze disk images, memory dumps, and network captures for forensic evidence.

Community
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
aivos-xieaivos-xie
1

digital-forensics

Analyze disk, memory, and network data for digital forensics investigations.

Community
Advanced
ZurybrZurybr

sqlite-db-truncate

Recover data from truncated SQLite databases via binary page analysis.

Community
Advanced