Forensics
// 6 published technical guides
Forensics challenges hand you an artifact — a pcap, a disk image, a memory dump — and ask you to recover what happened or what was hidden inside.
› reference guides
- 01beginner
File Analysis Fundamentals
Identify mystery files, find hidden data in metadata, and extract embedded archives from any forensics challenge.
- 02beginner
PCAP Analysis
Read network captures in Wireshark, follow streams, and extract files and credentials from captured traffic.
- 03intermediate
Memory Forensics with Volatility
Extract processes, network connections, files, and credentials from a raw memory dump using Volatility.
- 04intermediate
Disk Image & Filesystem Forensics
Inspect disk images, parse Master File Tables (MFT), mount raw partitions, and carve deleted files using Sleuth Kit and Autopsy.
- 05beginner
System & Web Log Analysis
Parse web server logs, Linux syslogs, and Windows Event Logs to reconstruct attack timelines and detect compromise.
- 06intermediate
Windows Registry Forensics
Extract execution history, user activity, persistence mechanisms, and connected USB artifacts from Windows Registry hives.