kavklaw@llm ~ /guides/forensics-stego

kavklaw@llm $ cat forensics-stego-guide.md

Digital Forensics & Steganography

🔴 Advanced

⏱️ 25 min read · Analyze files, extract hidden data, and solve forensics CTF challenges

Most of these tools come pre-installed on Kali Linux. If you're on another distro (Ubuntu, Debian, Arch), install them individually:

# Core analysis tools (likely already on your system)
sudo apt install file binutils         # file, strings, xxd

# File extraction & carving
sudo apt install binwalk foremost scalpel

# Metadata
sudo apt install libimage-exiftool-perl  # exiftool

# Image steganography
sudo apt install steghide                # JPEG/BMP/WAV/AU stego
sudo gem install zsteg                   # PNG/BMP LSB analysis

# Stegsolve (Java GUI — download the JAR directly)
# wget https://github.com/Giotino/stegsolve/releases/latest/download/stegsolve.jar
# Run: java -jar stegsolve.jar

# Network forensics
sudo apt install wireshark tshark tcpflow

# Memory forensics
pip3 install volatility3

# Audio analysis
sudo apt install audacity sox

On Kali, most of these are already available. If a command isn't found, install the package above and you're set.

⚡ Quick Start

Got a mystery file in a CTF? Run this triage in under 60 seconds:

# Step 1: What IS this file?
# file identifies file types by examining internal signatures, not the extension
file mystery_file
# mystery_file: PNG image data, 1920 x 1080, 8-bit/color RGBA

# Step 2: Any strings hiding in there?
# strings extracts human-readable text from any file (even binaries)
strings mystery_file | head -50
strings -n 10 mystery_file | grep -iE "flag|ctf|key|password|secret"

# Step 3: Any embedded files?
# binwalk scans for files hidden inside other files (ZIP in a PNG, etc.)
binwalk mystery_file
binwalk -e mystery_file    # Extract anything found

# Step 4: Check metadata
# exiftool reads hidden metadata (author, GPS, software, dates, comments)
exiftool mystery_file

# Step 5: Steganography checks (data hidden within normal-looking files)
steghide extract -sf mystery_file.jpg -p ""   # JPEG/BMP/WAV/AU stego — try empty password
zsteg mystery_file.png                         # PNG/BMP — check for data in pixel bits
stegsolve                                      # Visual bit-plane analysis (GUI)

# Step 6: Hex analysis
# xxd shows the raw bytes — useful for checking file headers and hidden data
xxd mystery_file | head -20                    # Check header/magic bytes
xxd mystery_file | tail -20                    # Check footer/appended data

This covers 80% of CTF forensics challenges. Don't worry if some of these tools are unfamiliar — each one is broken down below.

🔤 Encoding vs Encryption vs Steganography

These three concepts are fundamentally different, and confusing them is a classic beginner mistake:

ENCODING — transforms data for compatibility (NOT security). Reversible without any key/secret:

echo "Hello" | base64          # SGVsbG8=
echo "SGVsbG8=" | base64 -d    # Hello
echo -n "Hello" | xxd -p       # 48656c6c6f (hex encoding)

Also: URL encoding, ASCII, Unicode, ROT13, binary.

ENCRYPTION — transforms data for CONFIDENTIALITY (requires a key). Reversible only WITH the correct key:

echo "Hello" | openssl enc -aes-256-cbc -a -salt -pass pass:MyKey
# U2FsdGVkX1+... (ciphertext — meaningless without the key)

Symmetric: AES, DES, ChaCha20 (same key encrypts + decrypts). Asymmetric: RSA, ECC (public key encrypts, private key decrypts).

STEGANOGRAPHY — HIDES data within other data. The carrier file looks normal. Examples:

Text hidden in an image's least significant bits (LSB)
Message hidden in audio frequencies
File appended after a JPEG's end marker
Data hidden in whitespace, zero-width characters, or metadata

In CTFs, you'll encounter all three. The challenge is figuring out WHICH technique was used, not necessarily breaking strong crypto.

📄 File Analysis Basics

The file command is your first tool. It identifies file types by examining magic bytes (the first few bytes of a file), not the file extension.

# Basic file identification
file mystery.bin
# mystery.bin: PNG image data, 800 x 600, 8-bit/color RGB

# The extension might be wrong!
file secret.txt
# secret.txt: Zip archive data, at least v2.0 to extract
# ↑ It's not a text file — it's a ZIP disguised with .txt extension!

# Check multiple files at once
file *

# MIME type output (useful for scripting)
file --mime-type mystery.bin
# mystery.bin: image/png

# strings — extract human-readable text from binary files
strings mystery.bin                      # Default: 4+ character strings
strings -n 8 mystery.bin                 # Minimum 8 characters
strings -e l mystery.bin                 # Little-endian 16-bit (Unicode)
strings -e b mystery.bin                 # Big-endian 16-bit (Unicode)

# Search for specific patterns
strings mystery.bin | grep -i "flag"
strings mystery.bin | grep -i "password"
strings mystery.bin | grep -oP "CTF{.*?}"        # Flag format
strings mystery.bin | grep -oP "[A-Za-z0-9+/=]{20,}" | while read b; do echo "$b" | base64 -d 2>/dev/null; echo; done
# ↑ Find and decode base64 strings

# Look at the end of files (data often appended after the legitimate content)
tail -c 1000 mystery.jpg | strings

🔍 Hex Analysis & Magic Bytes

Every file format starts with specific bytes called "magic bytes" or "file signatures." Corrupted, modified, or hidden files can be identified by examining these bytes.

# View hex dump
xxd mystery.bin | head -20     # First 20 lines
xxd mystery.bin | tail -20     # Last 20 lines (check for appended data)
hexdump -C mystery.bin | head  # Alternative hex viewer

Common magic bytes (file signatures):

PNG:    89 50 4E 47 0D 0A 1A 0A  (‰PNG....)
JPEG:   FF D8 FF                  (ÿØÿ)
GIF:    47 49 46 38               (GIF8)
BMP:    42 4D                     (BM)
PDF:    25 50 44 46               (%PDF)
ZIP:    50 4B 03 04               (PK..)
RAR:    52 61 72 21               (Rar!)
GZIP:   1F 8B                     (..)
7z:     37 7A BC AF               (7z..)
ELF:    7F 45 4C 46               (.ELF)
EXE:    4D 5A                     (MZ)
PCAP:   D4 C3 B2 A1               (libpcap)
SQLite: 53 51 4C 69 74 65         (SQLite)

File footer signatures:

PNG:    49 45 4E 44 AE 42 60 82   (IEND®B`‚)
JPEG:   FF D9                      (ÿÙ)
PDF:    25 25 45 4F 46             (%%EOF)

Fix corrupted magic bytes:

# Fix corrupted magic bytes
# Challenge gives you a file that doesn't open?
# Check if the header is corrupted:
xxd mystery.bin | head -1
# 00000000: 0000 4e47 0d0a 1a0a ...
# ↑ Should be 8950 for PNG! First 2 bytes are wrong

# Fix with hex editor or python:
printf '\x89\x50' | dd of=mystery.bin bs=1 count=2 conv=notrunc
# Or with Python:
python3 -c "
data = open('mystery.bin','rb').read()
fixed = b'\x89\x50' + data[2:]
open('fixed.png','wb').write(fixed)
"

# Check for data after file footer
# JPEG files end with FF D9. Anything after that is suspicious:
python3 -c "
data = open('image.jpg','rb').read()
end = data.find(b'\xff\xd9')
if end != -1 and end + 2 < len(data):
    extra = data[end+2:]
    print(f'Found {len(extra)} bytes after JPEG footer!')
    open('hidden_data.bin','wb').write(extra)
"

💡 Pro Tip: In CTFs, corrupted file headers are a classic challenge. If file says "data" (unknown), check the first few bytes with xxd and compare against known magic bytes. Fix the header and the file opens, revealing the flag.

🔬 Binwalk — Embedded File Extraction

Binwalk scans a file for embedded files and executable code. It's one of the first tools to reach for in firmware analysis and CTF forensics.

# Scan for embedded files (don't extract)
binwalk mystery.bin
# DECIMAL       HEXADECIMAL     DESCRIPTION
# 0             0x0             PNG image, 800 x 600
# 491520        0x78000         Zip archive data
# 491634        0x78072         End of Zip archive
# ↑ There's a ZIP file hidden inside the PNG!

# Extract embedded files
binwalk -e mystery.bin
# Creates: _mystery.bin.extracted/ directory
# Inside: the extracted ZIP, PNG, and any other embedded files

# Recursive extraction (extract files within files)
binwalk -eM mystery.bin
# -M = matryoshka mode (recursive, like Russian nesting dolls)

# Entropy analysis (find encrypted/compressed sections)
binwalk -E mystery.bin
# High entropy (close to 1.0) = encrypted or compressed data
# Low entropy = plaintext or structured data
# Sudden entropy changes = file boundaries

# Scan for specific signatures
binwalk -R "\x89PNG" mystery.bin     # Find PNG headers
binwalk -R "flag{" mystery.bin       # Find flag strings

# Custom extraction with dd
# If binwalk finds something at offset 0x78000:
dd if=mystery.bin of=extracted.zip bs=1 skip=$((0x78000))

# Binwalk for firmware analysis:
binwalk firmware.bin
# Often reveals: bootloader, kernel, filesystem (squashfs, jffs2, cramfs)
binwalk -e firmware.bin
# Extracts the filesystem → browse for configs, passwords, keys

🔪 File Carving

File carving recovers files from raw data (disk images, memory dumps, network captures) by searching for file headers and footers, without relying on filesystem metadata (the file tables that normally track where files are stored). Think of it like finding whole pages in a shredded book by recognizing how pages start and end.

# foremost — header/footer-based file carver
foremost -i disk_image.dd -o recovered/
foremost -i mystery.bin -o recovered/
# Creates directories: jpg/ png/ pdf/ zip/ etc.
# Each containing recovered files

# Customize foremost config for specific file types
cat /etc/foremost.conf
# You can add custom header/footer signatures

# scalpel — faster, more configurable carver
scalpel -c /etc/scalpel/scalpel.conf -o recovered/ disk_image.dd

# Edit scalpel.conf to enable/disable specific file types:
# Uncomment the types you want to carve:
# jpg   y   200000000   \xff\xd8\xff\xe0\x00\x10   \xff\xd9
# png   y   200000000   \x89\x50\x4e\x47           \x49\x45\x4e\x44
# pdf   y   200000000   \x25\x50\x44\x46           \x25\x25\x45\x4f\x46

# photorec — the most powerful file carver (from TestDisk suite)
photorec disk_image.dd
# Interactive menu:
# 1. Select media type
# 2. Select partition type
# 3. Select filesystem type
# 4. Choose where to save recovered files
# Recovers hundreds of file types automatically

# bulk_extractor — extracts useful information from disk images
bulk_extractor -o output/ disk_image.dd
# Extracts: email addresses, URLs, credit card numbers, phone numbers,
# network packets, JPEG images, GPS coordinates, etc.

🖼️ Image Steganography

Images are the most common steganography carrier in CTFs. Data can be hidden in multiple ways: metadata, appended data, least significant bits (the smallest bit in each color value, where a change is invisible to the human eye), color channels, or alpha transparency.

steghide (JPEG/BMP)

# Extract hidden data (with passphrase)
steghide extract -sf image.jpg -p "password"

# Extract with empty passphrase (common in CTFs!)
steghide extract -sf image.jpg -p ""

# Check if data is embedded (without extracting)
steghide info image.jpg

# Embed data (for understanding how it works)
steghide embed -cf cover.jpg -ef secret.txt -p "password"

# Brute force the passphrase with stegcracker
stegcracker image.jpg /usr/share/wordlists/rockyou.txt

# steghide supports JPEG, BMP, WAV, and AU cover files. For PNG, use zsteg/stegsolve

zsteg (PNG/BMP)

# zsteg — detect LSB steganography in PNG and BMP images
zsteg image.png
# Output:
# b1,r,lsb,xy .. text: "flag{hidden_in_the_pixels}"
# b1,rgb,lsb,xy .. file: "PK\x03\x04" (ZIP archive)
# ↑ Found flag in red channel LSB!

# Check all channels and bit planes
zsteg -a image.png

# Extract specific payload
zsteg -e "b1,r,lsb,xy" image.png > extracted.txt

# Understanding zsteg output:
# b1 = bit 1 (LSB), b2 = bit 2, etc.
# r = red, g = green, b = blue, rgb = all channels
# lsb = least significant bit first
# xy = read pixels left-to-right, top-to-bottom

stegsolve (Visual Analysis — GUI)

java -jar stegsolve.jar

Features:

Bit plane browser — Browse individual planes (Red 0, Red 1, Green 0, etc.). Hidden images often appear in the LSB plane.
Frame browser — For animated GIFs where each frame might be different.
Image combiner — XOR, AND, OR two images. Used with "before" and "after" images; XOR reveals differences → hidden data.
Data extractor — Extract data from specific bit planes and channels. Configure bit order, MSB/LSB, RGB order.

Common stegsolve workflow: (1) Load the image, (2) Click through bit planes with ← → arrows, (3) Look for hidden text, QR codes, or patterns in low bit planes, (4) If you have two images: use Image Combiner → XOR.

LSB Steganography (Manual)

# LSB (Least Significant Bit) steganography hides data in the lowest bit
# of each pixel's color value. Changing the LSB is invisible to the human eye.

# How it works:
# Original pixel:  R=148 (10010100), G=200 (11001000), B=73 (01001001)
# Modified pixel:  R=149 (10010101), G=200 (11001000), B=72 (01001000)
#                        ↑ bit=1              ↑ bit=0          ↑ bit=0
# Hidden bits: 1, 0, 0 → part of a hidden message

# Extract LSB data with Python
from PIL import Image

img = Image.open("stego.png")
pixels = img.load()
width, height = img.size

binary = ""
for y in range(height):
    for x in range(width):
        r, g, b = pixels[x, y][:3]
        binary += str(r & 1)  # Extract LSB of red channel

# Convert binary to text
message = ""
for i in range(0, len(binary), 8):
    byte = binary[i:i+8]
    if len(byte) == 8:
        char = chr(int(byte, 2))
        if char == '\x00':  # Null terminator
            break
        message += char

print(message)

# Other image stego tools:
# openstego — Java-based stego tool
# jsteg — JPEG steganography (DCT coefficients)
# Invisible Secrets — Windows GUI tool
# OutGuess — JPEG steganography
# pngcheck — validate PNG structure (detect corrupted chunks)

💡 Pro Tip: When you see an image in a CTF, always run this sequence: file → exiftool → strings → binwalk → steghide (JPEG) or zsteg (PNG) → stegsolve. This covers 95% of image stego challenges. If nothing works, check if the image dimensions or palette are unusual — data might be hidden in extra pixels or custom palette entries.

🔊 Audio Steganography

Audio files can hide information in spectrograms, frequency domains, waveform patterns, or embedded metadata.

Spectrogram analysis — the most common audio stego technique. Open the audio in Audacity or Sonic Visualiser → View → Spectrogram. Hidden images/text appear as visual patterns!

Common tools: Audacity (free audio editor), Sonic Visualiser (specialized analysis), sox (command-line).

# Create a spectrogram image from audio:
sox audio.wav -n spectrogram -o spectrogram.png

# Check audio metadata
exiftool audio.mp3
exiftool audio.wav

# Strings in audio files (comments, hidden text)
strings audio.wav | grep -i flag
strings audio.mp3 | grep -i flag

# DTMF (Dual-Tone Multi-Frequency) — the beep tones a phone makes when
# you press buttons. Each digit has a unique frequency pair; multimon-ng
# decodes the tones back into the numbers that were "dialed"
multimon-ng -t wav audio.wav
# Output: DTMF: 1 2 3 4 5 6 7 8 ← phone number or code

# SSTV (Slow-Scan Television) — a method of transmitting images as audio
# signals (used by ham radio operators). Decode the audio back into an image:
sstv -d audio.wav -o output.png

# LSB audio steganography (similar to image LSB but on audio samples)
python3 -m wavsteg -r -i stego.wav -o extracted.txt -n 1  # 1 LSB per sample

# Check for embedded files in audio
binwalk audio.wav

# Reversed audio — play backwards to hear hidden message
sox audio.wav reversed.wav reverse

Other techniques to check: Morse code (dots and dashes — use online decoder). WAV files have a well-defined RIFF header — extra chunks or data after the audio data may contain hidden content.

📑 PDF Analysis

PDFs are complex documents that can contain embedded files, JavaScript, hidden text layers, and obfuscated content.

# Basic PDF analysis
file document.pdf
strings document.pdf | head -50
strings document.pdf | grep -i "flag\|password\|secret"

# pdftotext — extract text (including hidden text layers)
pdftotext document.pdf output.txt
cat output.txt

# PDF metadata
exiftool document.pdf
pdfinfo document.pdf

# Extract embedded files from PDF
binwalk document.pdf
binwalk -e document.pdf

# pdf-parser — analyze PDF structure
python3 pdf-parser.py document.pdf
python3 pdf-parser.py -f document.pdf     # Filter for specific elements
python3 pdf-parser.py -o 5 document.pdf   # Examine object #5

# peepdf — interactive PDF analysis (find malicious content)
peepdf -i document.pdf

Useful peepdf commands: info (document info), tree (structure), js_analyse (find JavaScript), extract raw 5 > out.bin (extract stream from object #5).

# qpdf — PDF manipulation (remove encryption, linearize)
qpdf --decrypt protected.pdf decrypted.pdf
qpdf --show-encryption protected.pdf

# PDF password cracking
pdfcrack -f protected.pdf -w /usr/share/wordlists/rockyou.txt

Common PDF tricks in CTFs:

Text hidden behind images (select all → copy → paste elsewhere)
White text on white background (change background color)
Hidden PDF layers (open in editor, toggle layer visibility)
JavaScript embedded in PDF (runs on open)
Embedded files in PDF attachments (check "attachments" pane)
Steganography in PDF images (extract images → run stego tools)

📦 ZIP & Archive Tricks

Archive files (ZIP, RAR, 7z, tar.gz) are frequent CTF challenges. Common tricks include nested archives, password protection, corrupted headers, and hidden files.

# Basic ZIP examination
unzip -l archive.zip          # List contents without extracting
unzip -t archive.zip          # Test archive integrity
zipinfo archive.zip           # Detailed ZIP information

# Password-protected ZIPs
unzip archive.zip              # Prompts for password
# Crack with fcrackzip:
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt archive.zip
# -u = unzip to verify (important!)
# -D = dictionary mode
# -p = wordlist path

# Crack with john:
zip2john archive.zip > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Crack with hashcat:
zip2john archive.zip > hash.txt
# Extract hash, then:
hashcat -m 17200 hash.txt /usr/share/wordlists/rockyou.txt  # PKZIP
hashcat -m 13600 hash.txt /usr/share/wordlists/rockyou.txt  # WinZip

# ZIP known-plaintext attack (bkcrack)
# If you know part of a file inside the encrypted ZIP:
bkcrack -C encrypted.zip -c known_file.txt -p known_plaintext.txt
# Recovers internal keys → decrypt all files!
# Even works with partial known plaintext (as few as 12 bytes)

# Nested archives (matryoshka)
# Challenge might have: flag.zip → inside.tar.gz → deeper.7z → flag.txt
# Recursive extraction:
binwalk -eM archive.zip
# Or manually:
unzip archive.zip && cd extracted/
tar xzf inside.tar.gz && cd inside/
7z x deeper.7z

# RAR cracking
rar2john archive.rar > hash.txt
john hash.txt --wordlist=rockyou.txt

# ZIP bombs (be careful!)
# A small ZIP that expands to an enormous size
# Check before extracting: unzip -l archive.zip
# Look for suspiciously large uncompressed sizes

# CRC32 attack on small files
# If ZIP contains a very small file (1-6 bytes), you can brute force
# the content using the CRC32 checksum stored in the ZIP header
# Tool: https://github.com/kmyk/zip-crc-cracker

📋 Metadata Forensics

# exiftool — the Swiss Army knife of metadata
exiftool image.jpg
# Shows: camera model, GPS coordinates, creation date, software,
# author, thumbnail images, color profiles, and MUCH more

# Specific metadata fields
exiftool -GPSLatitude -GPSLongitude image.jpg  # GPS location
exiftool -Author -Creator image.pdf            # Document author
exiftool -all image.jpg                        # Every possible field

# Check for hidden metadata
exiftool -v3 image.jpg    # Verbose mode (raw data dumps)

# Thumbnail extraction (may differ from the main image!)
exiftool -b -ThumbnailImage image.jpg > thumbnail.jpg
# Sometimes the thumbnail is from a DIFFERENT photo (evidence tampering!)

# Metadata in different formats
exiftool document.docx     # Office documents have rich metadata
exiftool audio.mp3          # ID3 tags (artist, album, comments)
exiftool video.mp4          # Creation date, GPS, device info

# Remove all metadata (for operational security)
exiftool -all= -overwrite_original image.jpg

# Compare metadata between two files
exiftool -a -G image1.jpg > meta1.txt
exiftool -a -G image2.jpg > meta2.txt
diff meta1.txt meta2.txt

# CTF metadata tricks:
# 1. Flag hidden in EXIF comment field
# 2. GPS coordinates that encode a message (convert to text)
# 3. Modified creation/modification dates that spell something
# 4. Custom XMP fields with hidden data
# 5. Thumbnail that shows the original (uncropped) image

🌐 Network Forensics

Network forensics involves analyzing captured network traffic. This traffic is saved in PCAP files (Packet Capture — a standard format that records every network packet that crossed the wire). You'll use these to reconstruct events, extract transferred files, and find hidden communications. Wireshark is the standard GUI tool for PCAP analysis — it shows every packet with protocol details, lets you filter and search, and can reassemble entire conversations.

wireshark capture.pcap

Essential Wireshark display filters:

http                              # HTTP traffic only
dns                               # DNS queries
tcp.stream eq 5                   # Follow specific TCP stream
frame contains "flag"             # Search for string in packets
http.request.method == "POST"     # POST requests (may contain creds)
ftp-data                          # FTP file transfers
smtp                              # Email traffic
ip.addr == 192.168.1.100          # Traffic to/from specific IP

Extract files from PCAP: Wireshark → File → Export Objects → HTTP/SMB/TFTP/FTP/etc.

# Command-line PCAP analysis with tshark
tshark -r capture.pcap -q -z io,stat,1  # Traffic statistics
tshark -r capture.pcap -T fields -e http.request.uri  # Extract HTTP URLs
tshark -r capture.pcap -T fields -e dns.qry.name | sort -u  # DNS queries
tshark -r capture.pcap -Y "http.request.method==POST" -T json  # POST data

# Extract HTTP objects
tshark -r capture.pcap --export-objects http,exported_files/

# Follow TCP streams (reconstruct conversations)
tshark -r capture.pcap -z follow,tcp,ascii,0  # Stream 0
tshark -r capture.pcap -z follow,tcp,ascii,1  # Stream 1

# tcpflow — extract all TCP streams as files
tcpflow -r capture.pcap -o output/

# scapy — Python packet manipulation
from scapy.all import *
packets = rdpcap("capture.pcap")
for pkt in packets:
    if pkt.haslayer(Raw):
        print(pkt[Raw].load)

Also consider NetworkMiner (Windows/Mono) for automatic PCAP analysis (extracts files, images, credentials, messages, DNS, sessions).

Common CTF PCAP analysis patterns:

HTTP downloads → extract transferred files
DNS exfiltration → data encoded in DNS query names
FTP transfers → reconstruct uploaded/downloaded files
SMTP → read email contents and attachments
Telnet/SSH → reconstruct terminal sessions
Covert channels → data hidden in ICMP, TCP seq numbers, timing

🧠 Memory Forensics (Volatility3)

Memory forensics analyzes RAM dumps (snapshots of a computer's memory) to extract running processes, network connections, passwords, encryption keys, and more. This is powerful because RAM often contains data that was never saved to disk, like decrypted passwords and active network sessions.

# Volatility 3 — the standard memory forensics framework
# Install: pip3 install volatility3

# Identify the OS profile (Volatility 3 auto-detects)
vol -f memory.dmp windows.info

# List running processes
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.pstree    # Tree view (parent-child)
vol -f memory.dmp windows.psscan    # Find hidden/terminated processes

# Network connections
vol -f memory.dmp windows.netscan
# Shows: PID, local address, remote address, state
# Look for: connections to suspicious IPs, unusual ports

# Command-line history
vol -f memory.dmp windows.cmdline
# Shows what commands each process was started with
# Might reveal: passwords in arguments, file paths, attacker tools

# Environment variables
vol -f memory.dmp windows.envars

# Dump a specific process (extract its executable)
vol -f memory.dmp windows.dumpfiles --pid 1234

# Extract files from memory
vol -f memory.dmp windows.filescan    # List all file objects in memory
vol -f memory.dmp windows.dumpfiles --virtaddr 0xFFFF...

# Registry analysis
vol -f memory.dmp windows.registry.hivelist    # List loaded registry hives
vol -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"
# ↑ Check autorun entries for persistence

# Password extraction
vol -f memory.dmp windows.hashdump    # SAM database password hashes
vol -f memory.dmp windows.lsadump     # LSA secrets
vol -f memory.dmp windows.cachedump   # Cached domain credentials

# Browser history and credentials
vol -f memory.dmp windows.iehistory   # Internet Explorer history (Volatility 2 plugin; not available in Volatility 3)

# Linux memory analysis
vol -f memory.dmp linux.bash          # Bash history
vol -f memory.dmp linux.pslist        # Process list
vol -f memory.dmp linux.check_syscall # Check for rootkits

# Strings search in memory dump
strings memory.dmp | grep -i "flag{"
strings memory.dmp | grep -i "password"
strings -e l memory.dmp | grep -i "flag"  # Unicode strings

# Timeline analysis (chronological events)
vol -f memory.dmp timeliner.TimeLiner

💡 Pro Tip: In CTF memory forensics challenges, always run windows.pslist first (or linux.pslist for Linux). Look for unusual process names, processes with suspicious parent-child relationships, or known attacker tools (mimikatz, meterpreter, nc). Then dump those processes and analyze them. If this feels overwhelming, don't worry — you'll only see a few of these commands in most CTF challenges. Start with pslist and cmdline, and you'll cover most beginner-level memory forensics problems.

💽 Disk Forensics Concepts

# Disk forensics examines storage media for evidence

# Disk imaging (create a forensic copy)
dd if=/dev/sda of=disk.dd bs=4M status=progress
# Or with dcfldd (forensic-aware dd):
dcfldd if=/dev/sda of=disk.dd hash=sha256 hashlog=hash.txt

# Mount a disk image
sudo mount -o ro,noexec,loop disk.dd /mnt/evidence
# -o ro → read-only (don't modify evidence!)
# -o noexec → don't execute any binaries

# Analyze filesystem
fls -r disk.dd              # List all files (including deleted!)
icat disk.dd INODE_NUM      # Extract file by inode number (recover deleted files)

# Autopsy — GUI forensic analysis (built on Sleuth Kit)
autopsy
# Web-based interface for browsing disk images
# Features: file recovery, timeline analysis, keyword search, hash analysis

# Sleuth Kit command-line tools:
mmls disk.dd                # List partitions
fsstat -o OFFSET disk.dd    # Filesystem statistics
fls -o OFFSET -r disk.dd   # List files in partition
istat -o OFFSET disk.dd INODE  # File metadata (timestamps, size, blocks)

# Recovering deleted files:
# When a file is "deleted," only the directory entry is removed.
# The actual data remains on disk until overwritten.
fls -d disk.dd              # List deleted entries (-d flag)
icat disk.dd DELETED_INODE > recovered_file

# File system specific:
# NTFS: MFT (Master File Table) contains all file metadata
# Look for: $MFT, $LogFile, $UsnJrnl for timeline reconstruction
# ext4: inodes, journal, superblock
# FAT: directory entries, FAT table, data area

🏆 Common CTF Forensics Patterns

Forensics Triage Pipeline
══════════════════════════════════════════════════════════════
  mystery_file
       │
       ▼
  ┌──────────┐   "data"?    ┌───────────┐
  │  file     │────────────▶│ Fix magic │──▶ Retry
  │  command  │             │ bytes     │
  └────┬─────┘             └───────────┘
       │ known type
       ▼
  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐
  │ strings  │  │ exiftool │  │ binwalk  │  │ xxd      │
  │ grep flag│  │ metadata │  │ embedded │  │ header/  │
  │          │  │ comments │  │ files    │  │ footer   │
  └──────────┘  └──────────┘  └──────────┘  └──────────┘
       │              │             │              │
       └──────────────┴─────────────┴──────────────┘
                              │
                     ┌────────┴────────┐
                     ▼                 ▼
               Image/Audio?     Archive/PCAP/Memory?
               steghide/zsteg   unzip/wireshark/volatility

Recognizing common patterns accelerates your CTF solving speed. Here are the most frequent challenge types:

# Pattern 1: Corrupted File Header
# file says "data" → check hex → fix magic bytes → file opens → flag inside
xxd challenge.bin | head -1
# Fix the first 2-8 bytes to match the expected file format

# Pattern 2: Data Appended After File Footer
# Normal-looking image → extra data after JPEG's FF D9 or PNG's IEND
binwalk image.jpg
# Extract the appended data → it's another file, a flag, or encoded text

# Pattern 3: LSB Steganography in PNG
# Normal-looking PNG → flag hidden in least significant bits
zsteg image.png
# Or extract manually with Python/stegsolve

# Pattern 4: JPEG with steghide
# JPEG image → steghide with empty password or simple password
steghide extract -sf image.jpg -p ""
stegcracker image.jpg rockyou.txt

# Pattern 5: Spectrogram in Audio
# WAV/MP3 file → view spectrogram → text/image visible
# Open in Audacity → Spectrogram view

# Pattern 6: Nested Archives (Matryoshka)
# ZIP → TAR → GZ → ZIP → ... → flag.txt
# Automate with: while true; do extract; done (recursive)

# Pattern 7: Memory Dump Analysis
# .vmem/.raw/.dmp file → Volatility → process list → find suspicious process
# → dump process → analyze binary → flag

# Pattern 8: PCAP Analysis
# Network capture → follow TCP streams → reconstruct file transfers
# Or: DNS exfiltration → decode subdomain names → flag

# Pattern 9: Base64/Hex/Binary Encoding Chain
# strings output shows: encoded data → decode base64 → hex → binary → flag
echo "Q1RGe2ZsYWd9" | base64 -d    # CTF{flag}

# Pattern 10: EXIF Metadata
# Flag hidden in image EXIF comment, GPS coordinates, or custom fields
exiftool challenge.jpg | grep -i "comment\|description\|flag"

# Pattern 11: File Type Mismatch
# File extension doesn't match content → rename with correct extension
file mystery.txt    # "mystery.txt: PNG image data"
mv mystery.txt mystery.png && eog mystery.png

# Pattern 12: QR Code Hidden in Image
# After stego extraction or bit-plane analysis → QR code appears
# Scan with: zbarimg extracted_qr.png

# Pattern 13: Whitespace Steganography
# Text file looks empty or normal → hidden data in spaces/tabs
# Tool: stegsnow
stegsnow -C message.txt
# Or check for zero-width characters (Unicode steganography)

🎯 Real-World Methodology

Phase 1: Initial Triage (2 min)

file — identify the file type
strings — look for readable clues
xxd — check magic bytes and structure
exiftool — examine metadata
binwalk — check for embedded files

Phase 2: Format-Specific Analysis (5 min)

Image? → steghide/zsteg/stegsolve → LSB analysis
Audio? → Audacity spectrogram → DTMF/morse decode
PDF? → pdftotext → extract embedded → JavaScript analysis
Archive? → Extract, crack password if needed
PCAP? → Wireshark → follow streams → export objects
Memory? → Volatility → pslist → dump suspicious processes
Disk? → mount → fls → recover deleted files

Phase 3: Deep Dive (as needed)

If nothing found: try different encoding/decoding
Check for corrupted headers (compare with valid files)
Compare two similar images (XOR them)
Check data after file footers
Try all steganography tools with common passwords
Look at the challenge description for hints about the technique used

⚠️ Common Mistakes

❌ Mistake #1: Trusting the file extension.
A .txt file might be a ZIP. A .jpg might be a PNG. Always use file to check the actual type based on magic bytes. Rename with the correct extension before proceeding.

❌ Mistake #2: Not trying empty passwords.
In CTFs, steghide with an empty password (-p "") is extremely common. Always try it before reaching for password cracking tools. Also try the challenge name, the filename, and "password" as passwords.

❌ Mistake #3: Forgetting to check the end of the file.
Data appended after a file's legitimate footer (after JPEG's FF D9 or PNG's IEND) is a classic hiding technique. binwalk catches this, but manual xxd | tail inspection is also valuable.

❌ Mistake #4: Only using one stego tool.
steghide only works on JPEG/BMP. zsteg only works on PNG/BMP. stegsolve is visual only. Use the right tool for the right format, and try multiple tools — each detects different hiding methods.

❌ Mistake #5: Ignoring audio spectrograms.
If you get a WAV or MP3 file that sounds like noise, static, or even normal music, always check the spectrogram in Audacity. Hidden images and text in spectrograms are one of the most common audio stego techniques.

❌ Mistake #6: Not reading challenge hints.
CTF challenge descriptions and titles often hint at the technique. "Invisible" suggests steganography. "Layers" suggests image bit planes or nested archives. "Echo" might mean audio stego. "Dead memory" means memory forensics. Read the hints!

❌ Mistake #7: Skipping strings on binary files.
Running strings is trivial and often reveals flags, passwords, or clues hiding in plain sight within binary data. Always do it, even if the file type seems obvious.

🧠Knowledge Check — File Analysis & Steganography

What tool extracts embedded files and firmware from binary data?

binwalk scans binary files for embedded signatures (ZIP, gzip, ELF, JPEG, etc.) and can extract them with binwalk -e file. It's the first tool to run on any unknown file in a CTF.

Complete the command to extract hidden data from a JPEG using steghide:

$ steghide  image.jpg

steghide extract -sf image.jpg extracts hidden data from a JPEG or BMP file. If password-protected, add -p password. Use steghide info image.jpg first to check if data is embedded.

Which tool is best for analyzing PNG files for LSB (Least Significant Bit) steganography?

zsteg detects LSB steganography in PNG and BMP files. Run zsteg image.png to check all bit planes. steghide doesn't support PNG — this is a common CTF mistake.

📝

Final Assessment: Digital Forensics & Steganography

0 / 5

What does the file command check to identify file types?

The file command reads magic bytes — signature patterns at the start of files. For example, FF D8 FF = JPEG, 89 50 4E 47 = PNG, 50 4B 03 04 = ZIP. This is why renaming a .exe to .jpg doesn't fool forensic tools.

In a CTF, you find a file that file reports as a PNG, but the image looks normal. What should you try first?

The CTF methodology for image files: strings image.png | less (hidden text), exiftool image.png (metadata/comments), binwalk -e image.png (embedded files), and zsteg image.png (LSB stego). Run all of them — flags can hide anywhere.

What Volatility3 command lists running processes from a memory dump?

vol3 -f dump.raw windows.pslist lists all processes. windows.pstree shows the parent-child hierarchy. For hidden processes, use windows.psscan which scans pool tags instead of the active process list.

What technique hides data after a file's legitimate end-of-file marker?

Data appended after a file footer (like JPEG's FF D9 or PNG's IEND chunk) is invisible to image viewers but detectable with binwalk or xxd | tail. This is one of the most common CTF stego techniques.

How do you check an audio file for hidden messages in a spectrogram?

In Audacity, click the track dropdown → Spectrogram view. Hidden messages, QR codes, or flags are often encoded as visual patterns in the frequency domain. This is a classic CTF challenge type. sonic-visualiser offers even more advanced spectrogram options.

📚 Further Reading

Nmap Guide — Network scanning fundamentals
Stego Toolkit — Docker image with all stego tools pre-installed
Volatility3 Documentation — Memory forensics framework
Wireshark Documentation — Network forensics reference
CTF Wiki — Misc/Forensics — Community-driven forensics reference
StegOnline — Browser-based image stego analysis
Learning Path — Where forensics fits in the bigger picture