All labs

Digital Forensics

Investigate files, logs and images the way a real analyst does. Each challenge hides a flag in a different way, and finding it teaches one forensic technique.

Briefing

An unknown file lands on your desk and you have to say what it is and what it's hiding. Each challenge hides a flag a different way, and getting it out teaches one technique an analyst uses every day.

You'll learn to

  • Find readable text and identify a file from its signature, not its name
  • Decode data hidden in plain sight, and read a photo's metadata
  • Follow a web server log to the request that mattered
  • Pull a message out of an image's pixels
0 of 8 steps done0%
Start: What forensics is
Before you investigateOptional warm-upFile signatures, base64, metadata and what a log line tells you. About ten minutes.

  1. What forensics is

    Up next

    Looking at what is there, not what should be

  2. Strings in a binary

    Readable text in a sea of machine code

  3. File signatures

    The name says text. The bytes say otherwise.

  4. How encoding works

    Base64 is not encryption, and that matters

  5. Metadata secrets

    What the file says about itself

  6. Log detective

    Reconstruct what happened from what was recorded

  7. Pixel secrets

    Data hidden in the noise floor of an image

  8. Where to go next

    Real challenges, real tools, real incidents