Advanced Digital Forensics
Once you can read metadata and carve files, real forensics turns into reverse engineering. These challenges make you trace encoder binaries that hide the flag inside images, decrypt TLS sessions from a leaked private key, recover data shuffled by a timestamp-seeded PRNG, and read secrets leaked through timing differences. This path assumes you are already comfortable with exiftool, Wireshark, and basic steganography.
Guides for this path
Read these alongside the challenges below. The first one orients you; the rest go deeper on the techniques each step needs.
- Steganography Techniques for CTF CompetitionsCTF steganography techniques: LSB pixel manipulation, file-within-file extraction, audio spectrograms, and metadata analysis, plus when to use each one.
- Audio Steganography and Spectrograms for CTF ForensicsAudio steganography for CTF: find flags in WAV and MP3 files via spectrogram text, SSTV images, DTMF tones, LSB samples, Morse, and reversed audio, using sox.
- Wireshark and pcap Analysis for CTF ForensicsWireshark and tshark for CTF: analyze pcap files, follow TCP streams, find credentials, extract files, reconstruct DNS exfiltration, and apply display filters.
- Base64, Hex, and Common CTF Encodings ExplainedCTF encodings decoded: identify and crack Base64, hex, binary, octal, ROT13, URL encoding, Morse, and more, with a copy-paste one-liner for each format.
- Side-Channel Attacks for CTF: Timing, Power, Compression, and Cache OraclesRecover secrets from what a program leaks rather than what it outputs: timing leaks, correlation power analysis, compression oracles, and cache eviction channels.
- When strings Won't Cut It: Volatility 3 for CTF Memory ForensicsFive Volatility 3 plugins in the right order solve most CTF memory dumps. A decision tree for CTF players, plus a two-way walkthrough of picoCTF 2025 Bitlocker-2.
- Step 01
Steganographic Encoder Reversing
The hardest stego challenges do not hand you a tool that just extracts the flag. Instead a binary reads flag.txt and scatters its bytes across pixel data using custom logic. You have to reverse the encoder to write the matching decoder. The Investigative Reversing series builds this skill one transformation at a time, and Invisible WORDs hides characters in whitespace a normal viewer never renders.
- Step 02
Decrypting Captured Traffic
Packet captures are not always plaintext. When a session is TLS-encrypted, you need the server's private key to decrypt it inside Wireshark before you can read the HTTP exchange. The WebNet challenges give you the key and the capture and ask you to reconstruct the conversation hiding the flag.
- Step 03
Custom Encoding Schemes
Some artifacts are passed through a homegrown encoder with multiple transformation passes before being written out. There is no off-the-shelf decoder. You read the encoder logic, understand each pass, and invert it. These two challenges escalate from a single transform to a layered multi-pass scheme.
- Step 04
Timing and Statistical Side-Channels
Sometimes the data is not hidden in a file at all but leaks through behavior. SideChannel recovers a PIN because each correct digit makes the checker take measurably longer, and scrambled-bytes recovers an image because UDP packet timestamps seeded the shuffle PRNG. This is where forensics meets cryptographic side-channel analysis.
- Step 05
Deep Multi-Layer Investigations
The capstone challenges layer everything: disk images with IRC logs and slack-space data, steghide-protected bitmaps, golden-ratio-base encoding, and nested file carving. Solving them means orchestrating the entire forensics toolkit in the right order, exactly like a real incident-response investigation.