At PicoCTF 2025, hundreds of competitors stalled on a forensics challenge because they started carving files before checking the most obvious place — the filesystem metadata. That mistake costs points every single time. A repeatable methodology stops you from chasing rabbit holes and gets you to the flag faster.
Step 1: Triage the Evidence Before You Touch Anything
The first sixty seconds should be information gathering, not tool-launching. Know what you have before you decide how to attack it. Run file and xxd on everything — file extensions lie, magic bytes don’t.
$ file challenge.img
challenge.img: DOS/MBR boot sector; partition 1: ID=0x83, active, start-CHS (0x0,2,3),
end-CHS (0x3ff,253,63), startsector 2048, 204800 sectors;
partition 2: ID=0x82, start-CHS (0x3ff,253,63), end-CHS (0x3ff,253,63),
startsector 206848, 4096 sectors
$ xxd challenge.img | head -4
00000000: eb63 9010 8ed0 bc00 b0b8 0000 8ed8 8ec0 .c..............
00000010: fbbe 007c bf00 06b9 0002 f3a4 ea21 0600 ...|.........!..
That output tells you this is a real partitioned disk image with a Linux ext partition and a swap partition — not a raw file dump. The MBR signature at offset 0 confirms it. Your next move is mounting it read-only and listing filesystem timestamps with fls from The Sleuth Kit.
$ sudo mount -o ro,loop,offset=$((2048*512)) challenge.img /mnt/ctf
$ ls -la /mnt/ctf/home/jmartin/
total 48
drwxr-xr-x 4 1000 1000 4096 Jun 14 03:17 .
drwxr-xr-x 3 root root 4096 Jun 13 22:01 ..
-rw------- 1 1000 1000 342 Jun 14 03:17 .bash_history
-rw-r--r-- 1 1000 1000 807 Jun 14 03:04 .profile
drwxr-xr-x 2 1000 1000 4096 Jun 14 03:16 .ssh
-rw-r--r-- 1 1000 1000 1337 Jun 14 03:15 notes.txt
A .bash_history file modified at 03:17 — two minutes after notes.txt — is a narrative. Read them in chronological order. The user jmartin was active in a tight window, which usually means the flag is buried in something they touched during that session. Check .ssh/ for private keys and authorized_keys next.
Step 2: Memory Dumps Demand a Different Playbook
Memory forensics is its own discipline. Volatility 3 is the standard tool — it extracts process lists, network connections, and injected shellcode from raw RAM captures. Always identify the OS profile first, then enumerate processes before diving into anything else.
$ python3 vol.py -f memory.dmp windows.info
Variable Value
-------- -----
KdVersionBlock 0xf80002be0068
Major/Minor 15.7601
MachineType 34404
KeSystemCalls 0
KdDebuggerEnabled False
NtSystemRoot C:\Windows
NtBuildLab 7601.win7sp1_rtm.101119-1850
$ python3 vol.py -f memory.dmp windows.pslist
PID PPID ImageFileName Offset Threads Handles
4 0 System 0xe0000... 82 511
276 4 smss.exe 0xe1000... 3 37
1204 508 explorer.exe 0xe2000... 21 440
2888 1204 cmd.exe 0xe3000... 1 20
3012 2888 powershell.exe 0xe4000... 8 210
3144 3012 notepad.exe 0xe5000... 1 55
That process tree is suspicious. powershell.exe spawned from cmd.exe, which spawned from explorer.exe — plausible. But then notepad.exe is a child of PowerShell. Legitimate Notepad launches from Explorer, not a shell. This is a classic sign of a payload using Notepad as a cover. Dump that process memory and scan it for strings.
$ python3 vol.py -f memory.dmp windows.memmap --pid 3144 --dump
$ strings pid.3144.dmp | grep -i flag
flag{m3m0ry_n3v3r_l13s_4b0ut_wh4t_r4n}
There it is. The flag was sitting in the heap of a process that looked innocent at first glance. If you had started with strings on the full dump, you might have found it — but you also might have spent an hour wading through noise. The methodology got you there in three commands.
Step 3: File Carving and Steganography — Last Resort, Not First
Beginners reach for binwalk and steghide immediately. Experienced players use them after exhausting metadata, strings, and filesystem artifacts. Carving is expensive and noisy. Use it when you have nothing else.
When you do carve, be targeted. If a challenge gives you a JPEG and a hint about hidden data, run steghide with an empty passphrase first — challenge authors often don’t add one.
$ steghide extract -sf suspicious.jpg -p ""
wrote extracted data to "secret.txt"
$ cat secret.txt
flag{st3g0_1s_0bvi0us_wh3n_y0u_kn0w_wh3r3}
If that fails, try common wordlists with stegseek — it’s orders of magnitude faster than manual guessing. If steganography yields nothing, check EXIF data with exiftool. GPS coordinates, author fields, and comments have all hidden flags in real CTFs.
What To Do Now
Download the CyberDefenders free lab “AfricanFalls” — it’s a disk image with a full forensic investigation chain. Mount it, run the triage commands from Step 1, and document every artifact you find before touching a carving tool. That single practice run will lock in the methodology better than any amount of reading.
