ctf-forensics

name	ctf-forensics
description	Forensics CTF guidance for immutable originals, extraction provenance, metadata, timelines, and safe recursion.

CTF Forensics

Use this skill for disk, memory, packet, document, image, archive, metadata, stego, and artifact-recovery challenges.

Focus

• Preserve original artifacts unchanged.
• Record parent-child extraction relationships.
• Limit extraction depth and size.
• Run low-cost metadata and strings checks before expensive stego paths.
• Store raw tool output as artifacts and pass summaries to models.

References

Read references/forensics-checklist.md when executing a forensics hypothesis.