forensics

name	forensics
description	Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.
allowed-tools	Bash, Read, Write, Grep, Glob

Forensics Analysis Skill

Quick Workflow

Progress:
- [ ] Identify file type (file, xxd)
- [ ] Check metadata (exiftool)
- [ ] Search strings for flag
- [ ] Check for embedded data (binwalk)
- [ ] Try steganography tools
- [ ] Extract hidden content

Step 1: Quick Analysis

file suspicious_file
exiftool suspicious_file
strings suspicious_file | grep -iE "flag|ctf|secret|key"
binwalk suspicious_file

Step 2: Identify Challenge Type

File Type	Approach	Reference
Image (PNG/JPG)	Steganography	reference/steganography.md
Memory dump	Volatility	reference/memory.md
Unknown/corrupted	File analysis	reference/file-analysis.md
PCAP	Network skill	Use networking skill

Image Stego - Quick Start

# Try AperiSolve first (online)
# https://www.aperisolve.com/

# PNG
zsteg image.png
zsteg -a image.png

# JPEG
steghide extract -sf image.jpg
stegseek image.jpg rockyou.txt  # Brute force

Full techniques: reference/steganography.md

Memory Dump - Quick Start

# Volatility 3
vol -f memory.dmp windows.info
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.filescan | grep -i flag

Full techniques: reference/memory.md

File Carving - Quick Start

binwalk -e suspicious_file      # Extract embedded files
foremost -i file -o output/     # Carve files

# Fix corrupted header
xxd file | head -10             # Check magic bytes

Full techniques: reference/file-analysis.md

Online Tools

Tool	URL	Purpose
AperiSolve	aperisolve.com	All-in-one stego
StegOnline	stegonline.georgeom.net	Image analysis
CyberChef	gchq.github.io/CyberChef	Data transform

Reference Files

• Steganography: Image/audio stego, LSB, AperiSolve
• Memory: Volatility 2/3, process analysis
• File Analysis: Magic bytes, binwalk, password cracking