This repository contains my digital forensics CTF write-ups, focusing on a structured DFIR-oriented analysis approach.
For each challenge, I follow a consistent workflow:
- Identify the structure of the evidence (disk image, file, etc.)
- Determine the correct starting point (e.g., partition offsets)
- Use appropriate tools depending on the scenario
- Analyze data at a low level when needed (offsets, inodes, artifacts)
- Validate findings before reaching conclusions
- Disk forensics
- File system analysis
- Artifact-based investigation
- DFIR methodology
This repository reflects my ongoing learning in digital forensics and will continue to grow over time.