Memory and disk forensics
Answer the three questions a memory image is asked - what was running, what was typed, what was on disk - and know why a scan beats a list.
By the end you can
- Distinguish a raw memory image from a crash dump or hibernation file before analysing it
- Explain why psscan finds processes pslist cannot, and what that costs in validation
- Recover command lines from a Windows image, including the UTF-16 problem
- Locate and carve a registry hive out of a dump and read persistence from it
- Read ext, FAT and NTFS structures well enough to recover a deleted or resident file
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
Memory dump, disk image and registry hive analysis
Scan a Windows memory image for processes, command lines, file objects and registry hives - and read ext4, FAT, NTFS $MFT and registry hives - entirely in the browser.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Hex viewer and hexdump
Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 26 match in total - see the full index.
Checkpoint
Given a raw Windows memory image, produce the process tree, identify the process that should not be there, and recover the command line it was started with.
Teaching note
The UTF-16 point lands better as a demonstration than as a statement: run strings without -el on a dump, get nothing, run it with -el, and get the whole command history. Students who see that once never forget it.