ctf-forensics

CTF Digital Forensics

In-Depth Reference

The following reference materialsload on demand, select the corresponding file based on the specific direction identified:

• Disk/Memory Forensics (Volatility/VM/VMDK/partition recovery/ransomware) → references/disk-and-memory.md
• Disk Recovery (LUKS/BTRFS/XFS/RAID5/anti-carving) → references/disk-recovery.md
• Windows Forensics (registry/SAM/event logs/WMI/Amcache) → references/windows.md
• Linux/Application Forensics (Docker/Git/browser/KeePass) → references/linux-forensics.md
• Network Forensics Basics (tcpdump/TLS decryption/SMB3/USB audio) → references/network.md
• Advanced Network Forensics (timing encoding/NTLMv2/TCP covert channel/DNS steganography) → references/network-advanced.md
• General Steganography (PDF/SVG/PNG/file overlay/terminal graphics) → references/steganography.md
• Image Steganography (JPEG DQT/BMP bit planes/F5 detection/palette) → references/stego-image.md
• Advanced Steganography (FFT/DTMF/audio/video frames/JPEG XL) → references/stego-advanced.md
• Advanced Steganography 2 (video frame accumulation/reversed audio/multi-layer PNG/EXIF chain) → references/stego-advanced-2.md
• Advanced Disk Forensics (deleted partition recovery/ZFS/LVM Thin/APFS snapshots) → references/disk-advanced.md
• Peripheral Capture Analysis (USB HID mouse drawing/keyboard capture decoding/Bluetooth) → references/peripheral-capture.md
• Hardware Signals (VGA/HDMI/DisplayPort/power side channel/keyboard acoustics) → references/signals-and-hardware.md
• 3D Printing Forensics (PrusaSlicer/G-code/QOIF) → references/3d-printing.md

---

Classification Decision Tree

拿到取证题？
├─ 文件分析
│  ├─ file/exiftool/binwalk → 识别格式与嵌入文件
│  ├─ 图片 → steghide/zsteg/stegsolve → [references/stego-image.md](references/stego-image.md)
│  ├─ 音频 → 频谱图/DTMF/SSTV → [references/stego-advanced.md](references/stego-advanced.md)
│  └─ PDF → 元数据/隐藏文本/多层 → [references/steganography.md](references/steganography.md)
├─ 磁盘/内存镜像
│  ├─ .dd/.img → mount -o loop,ro → fls/photorec
│  ├─ .ova/.vmdk → tar xf → 7z 提取
│  ├─ 内存 → Volatility3 (pslist/filescan/dumpfiles)
│  └─ RAID/ZFS/BTRFS → [references/disk-recovery.md](references/disk-recovery.md)
├─ 网络流量 (.pcap)
│  ├─ HTTP → tshark --export-objects
│  ├─ TLS → SSLKEYLOGFILE / 弱RSA密钥
│  ├─ SMB → 密钥解密 / NTLMv2 提取
│  └─ DNS → 隐蔽通道 / 尾字节编码
├─ Windows 事件日志 → [references/windows.md](references/windows.md)
├─ 硬件信号 → [references/signals-and-hardware.md](references/signals-and-hardware.md)
└─ 区块链 → mempool.space API / 剥离链追踪

Quick Start Commands

# 文件分析
file suspicious && exiftool suspicious && binwalk suspicious
strings -n 8 suspicious | grep -iE "flag|ctf"

# 磁盘取证
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd

# 内存取证 (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.filescan
vol3 -f memory.dmp windows.dumpfiles --physaddr ADDR

# 网络流量
tshark -r capture.pcap -Y "http" --export-objects http,/tmp/out

Steganography Quick Reference

Format	Tool	Description
JPEG	steghide / F5 detection	DQT table/DCT coefficient ratio
PNG/BMP	zsteg / stegsolve	bit planes/palette/LSB
Audio	multimon-ng / sox	DTMF/spectrum/reversal
Video	frame accumulation/frame-by-frame differencing	flicker-hidden QR
PDF	exiftool + binwalk	metadata/comments/data after EOF

Key Windows Event IDs

ID	Meaning
1102	Audit log cleared
4720	User created
4781	Account renamed
21 (TSLocal)	RDP login successful

Windows Event Logs

• EVTX analysis focuses on timestamps (TimeCreated / SystemTime) to sort key events