CTF Forensics

What I do

• Triage archives, disk images, pcaps, documents, images, audio, logs, and memory artifacts.
• Extract metadata and hidden content.
• Follow timelines, embedded payloads, and protocol traces.
• Turn discoveries into a clean evidence chain.

When to use me

Use this for artifact-heavy challenges where the main task is locating, extracting, or reconstructing hidden information.

Workflow