Forensics and steganography

In forensics challenges, you are handed evidence after the fact: a suspicious file, a disk image, a recording of network traffic. Something happened, and the flag is hidden in the traces it left behind. Your job is to investigate, not to attack.

The first rule is simple: don't trust a file's name. Calling something holiday.txt doesn't make it text.

Most file types begin with the same few bytes, called a file signature or magic bytes. Programs use them to identify files, and you can too. The file command checks them for you, and xxd shows you the raw bytes.

Time to open a case. strings is your best friend here: it pulls readable text out of any file, even binary ones like images. Combine it with grep to get straight to the point.

Case file opened. Start with: ls, then cat case-notes.txt

Metadata

Files carry hidden information about themselves. A phone photo might record the camera model, the time and even the GPS location. exiftool shows it all:

$ exiftool photo.jpg
File Name     : photo.jpg
Image Size    : 1920x1080
Camera Model  : Pixel 8
GPS Position  : 22 deg 34' 20.00" N, 88 deg 21' 50.00" E
Comment       : zda{ch3ck_th3_m3t4d4t4}

Network captures

A .pcap file is a recording of network traffic, and you open it with Wireshark. Three tricks get you a long way:

• Type a filter such as http or frame contains "zda" to cut the noise.
• Right-click a packet and choose Follow → TCP Stream to read a whole conversation as text.
• Use File → Export Objects → HTTP to pull out any files that were transferred.

Files inside files

binwalk scans a file for other files hidden inside it. An innocent-looking image with a ZIP attached to the end is a very common challenge.

Steganography means hiding the very existence of a message. Encryption makes a message unreadable, but everyone can see it is there. Steganography hides it so nobody thinks to look.

The classic digital version is the least significant bit trick. Each pixel's color is stored as numbers, and changing the very last bit changes the color so little that the eye can't tell. Use the last bit of thousands of pixels and you can hide a whole message. Tools like zsteg and steghide detect or extract this, and audio challenges often hide an image you can only see in a spectrogram.

Hidden messages don't have to be digital, though. One of the oldest tricks is hiding one in a piece of ordinary writing. Read this note closely:

Please keep this note somewhere safe,
In the drawer beneath the stairs.
Xerox copies are not allowed,
Every page must be signed,
Lock the door when you leave,
Some secrets are not what they seem.