Forensics
In a CTF context, "Forensics" challenges can include file format analysis, steganography, memory dump analysis, or network packet capture analysis. Any challenge to examine and process a hidden piece of information out of static data files (as opposed to executable programs or remote servers) could be considered a Forensics challenge (unless it involves cryptography, in which case it probably belongs in the Crypto category).
For solving forensics CTF challenges, the three most useful abilities are probably:
Knowing a scripting language (e.g., Python)
Knowing how to manipulate binary data (byte-level manipulations) in that language
Recognizing formats, protocols, structures, and encodings
The first and second you can learn and practice outside of a CTF, but the third may only come from experience. Hopefully with this document, you can at least get a good headstart.
And of course, like most CTF play, the ideal environment is a Linux system with – occasionally – Windows in a VM. MacOS is not a bad environment to substitute for Linux, if you can accept that some open-source tools may not install or compile correctly.
reference: https://trailofbits.github.io/ctf/for...
about me
/ relvilu
/ realvilu
blog
https://leetvilu.blogspot.in