CTF Forensics Methodology — A Beginner's Checklist
A step-by-step checklist for approaching forensics challenges in Capture the Flag competitions: file identification, metadata extraction, steganography, and log analysis.
Forensics challenges in CTF competitions test your ability to extract hidden information from files, images, network captures, and disk images. Unlike real-world forensics, CTF forensics is about finding a flag — a specific string like flag{...} — hidden somewhere in the provided artifact.
The key to CTF forensics is systematic methodology. Beginners often jump straight to specialized tools without first doing the basics. This checklist walks through the steps in order — from initial triage to deep analysis — so you don't miss obvious flags while chasing complex ones.
File identification
Run 'file <filename>' to identify the true file type by magic bytes, not the extension. A .jpg with a ZIP magic number (PK\x03\x04) is a ZIP file.
Run 'xxd <filename> | head -20' to inspect the raw hex. Look for embedded file signatures: PNG (\x89PNG), ZIP (PK), PDF (%PDF), JPEG (\xFF\xD8\xFF).
Run 'strings <filename>' to extract all printable ASCII strings. Flags are often hidden in plaintext inside binary files.
Check the file size. An unusually large image or audio file often contains appended data after the valid file content ends.
Metadata extraction
Run 'exiftool <filename>' on images, PDFs, and Office documents. EXIF data can contain GPS coordinates, camera model, author name, creation timestamps, and comments — any of which might be the flag or a clue.
Check PDF metadata: author, creator, producer, and creation date fields. PDFs can also contain hidden layers, invisible text, and embedded files.
For Office documents (.docx, .xlsx), rename to .zip and extract. The XML files inside often contain revision history, author names, and hidden content in the document XML.
Steganography
For images: try 'steghide extract -sf <file>' (common in CTFs). Also try zsteg (PNG/BMP LSB), stegsolve (visual bit-plane analysis), and binwalk (embedded files).
LSB (Least Significant Bit) steganography hides data in the last bit of each pixel's color channel. The image looks identical to the human eye but contains hidden data. zsteg and StegSolve detect this automatically.
For audio: open in Audacity and look at the spectrogram (View > Show Spectrogram). Flags are sometimes visible as text in the frequency domain. Also try 'strings' on WAV/MP3 files.
Run 'binwalk -e <file>' to extract embedded files. Many CTF challenges hide a ZIP or another image inside a JPEG by appending it after the JPEG end-of-image marker (\xFF\xD9).
Network captures (PCAP)
Open in Wireshark. Use Statistics > Protocol Hierarchy to see what protocols are present. HTTP, FTP, and DNS are the most common flag carriers in CTF PCAPs.
Follow TCP streams (right-click > Follow > TCP Stream) to read HTTP conversations. Look for POST bodies, cookies, and response content.
Filter for DNS: 'dns.qry.name contains "flag"' or look for unusually long subdomain queries that might be base64-encoded data.
Export HTTP objects (File > Export Objects > HTTP) to extract files transferred over HTTP. Images, ZIPs, and text files are common.
Log analysis
Sort log entries by timestamp to reconstruct the sequence of events. Look for the first occurrence of unusual activity — that's often where the flag or the attack started.
For web server logs: look for unusual HTTP status codes (403, 500), unusually long URLs (SQL injection, path traversal), and requests to non-existent paths.
For auth logs: look for failed login attempts followed by a success (brute force), logins at unusual hours, or logins from unexpected IP addresses.
Use 'grep -i flag' as a quick first pass. CTF organizers sometimes hide flags directly in log entries.
General tips for CTF forensics
Always check the challenge description for hints. 'Something is hidden in plain sight' usually means LSB steganography or whitespace encoding.
Try CyberChef for encoding/decoding. Many CTF flags are base64, hex, or ROT13 encoded.
If you're stuck, try a different tool. Different steganography tools detect different techniques — what zsteg misses, stegsolve might find.
Document your steps. In a team CTF, your teammates need to know what you've already tried.
Apply this methodology with ForensIQ
The Forensics module covers hash verification, metadata extraction, log analysis, and packet inspection — all the tools in this checklist, running entirely in your browser.
Open Forensics Module