Lesson pack 7 · Core · 90 minutes
File forensics and carving
Identify files by their bytes, find data appended past a format’s end marker, and pull evidence out of images and documents.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 8 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Identify a file’s real type regardless of extension
- Find and extract data hidden after a format’s terminator
- Read EXIF, PNG chunks, and JPEG segments for metadata and appended payloads
- Repair a deliberately corrupted header
Running order (90 min)
| Time | What happens |
|---|---|
| 0:00-0:09 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:09-0:27 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:27-0:50 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:50-1:21 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:21-1:30 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- File type identifier by magic bytes - Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.https://ctfpal.com/?tool=file-signature-identifier
- Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor
- Hex viewer and hexdump - Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.https://ctfpal.com/?tool=hex-viewer
- PNG chunk analyzer - Walk a PNG chunk by chunk, validate CRCs, read tEXt and zTXt metadata, and find data hidden after IEND or in non-standard chunks.https://ctfpal.com/?tool=png-chunk-analyzer
- EXIF metadata viewer - Read EXIF, GPS coordinates, camera details, timestamps, and embedded comments from images - the metadata that answers OSINT challenges.https://ctfpal.com/?tool=exif-viewer
- Magic byte and file signature table - Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.https://ctfpal.com/?tool=magic-byte-lookup
Reading
- The first ten minutes: a triage playbook for any CTF challenge - 8 min. Most challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Big Zip - picoGym Exclusive, easy
- CanYouSee - picoCTF 2024, easy
- Corrupted file - picoMini by CMU-Africa, easy
- First Grep - picoCTF 2019, easy
- Flag Hunters - picoCTF 2025, easy
- Glory of the Garden - picoCTF 2019, easy
- Information - picoCTF 2021, easy
- Obedient Cat - picoCTF 2021, easy
- Scan Surprise - picoCTF 2024, easy
- Secret of the Polyglot - picoCTF 2024, easy
- Static ain't always noise - picoCTF 2021, easy
- StegoRSA - picoCTF 2026, easy
Checkpoint (gradeable)
Given a polyglot file, extract every embedded file it contains and state the offset and signature of each.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
Students reach for the steganography solver too early here. Make them run strings and check the magic bytes first, every time - most 'stego' challenges at this level are a ZIP glued onto a PNG.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.