MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:29Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 97:		Line 97:
	[[Category:Windows Forensics\|001]]		[[Category:Windows Forensics\|001]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/windows/forensics/intro_forensics.md

2026-09-18T17:05:24Z

Import from cypat.guide: docs/windows/forensics/intro_forensics.md

New page

{{Submit}}

-----

Author(s): a_person

Last Updated: 05-30-2026

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== Digital Forensics ==

Think about a physical crime scene. An investigator would examine the scene, look for evidence, document their findings, and reconstruct what happened. Digital forensics is very similar. Instead of physical evidence, forensic analysts investigate logs, file systems, network traffic, and other artifacts to:

* identify evidence
* reconstruct exactly what happened
* determine the cause of an incident
* support legal investigations

Digital forensics is also a vital part of incident response (IR), which is the process an organization uses to detect, respond to, and recover from cyberattacks.

== What are forensics questions? ==

Forensics Questions are questions that ask about the current system, logs of attacks, or general information that has some relationship to the current system. These can ask you anything from CVEs, using logs to find indicators of compromise, or reversing a binary. They can also include file attachments which include, but are not limited to: network captures, images, and malware. They are usually located on the Desktop.

== Practice! ==

Here are some example, easy forensics questions that do not require much work:

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Find the CVEs fixed in Notepad++ v8.5.7'''
|-
|

'''Fixed CVEs:''' CVE-2023-40031, CVE-2023-40036, CVE-2023-40164, CVE-2023-40166<br /> '''Reference:''' [https://notepad-plus-plus.org/downloads/v8.5.7/ Notepad++ v8.5.7 Release Notes]

|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Decode the encrypted message''': <code>5a 47 39 75 61 32 56 35 49 47 6c 7a 49 47 35 76 64 43 42 7a 61 32 6c 69 61 57 52 70</code>
|-
|

'''Decoded:''' donkey is not skibidi<br />

You can decode it by decoding from hex, then decoding the result from Base64. Cyberchef link: https://cyberchef.org/#recipe=From_Hex('Auto')From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=NWEgNDcgMzkgNzUgNjEgMzIgNTYgMzUgNDkgNDcgNmMgN2EgNDkgNDcgMzUgNzYgNjQgNDMgNDIgN2EgNjEgMzIgNmMgNjkgNjEgNTcgNTIgNzA

|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''What is the publication timestamp (ISO 8601) for CVE-2025-4561?'''
|-
|

'''Timestamp:''' 2025-05-12T06:44:29.959Z<br /> '''Source:''' [https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/4xxx/CVE-2025-4561.json CVE Record on GitHub]

|}

Here is an example of conducting forensics on Windows Event Logs. This was a scrapped challange for a CTF. You may want to do some research if you are not familiar with them.

'''[https://cypat.guide/FQPractice.evtx Click here to download the file]'''

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Find the following information: the executable file downloaded and ran that was the malware, the name of the executable that abused an unquoted service path, the sensitive file that was accessed, the command that led the attacker to discover it, the registry value created for persistence of the PowerShell script uploading user data, and the FTP server port number.'''
|-
|

'''Answers:'''

<ul>
<li>update.exe</li>
<li>My.exe</li>
<li>passwords.txt</li>
<li>netshare</li>
<li>SysmonAgent</li>
<li>2222</li>
</ul>
|}

== What can I use for extra practice? ==

CTFs, practice images, and Hack the Box are great for forensics practice. Here are some websites you can use to practice them:

* https://picoctf.org/
* https://github.com/alphyos/CyberStart-2024
* https://imaginaryctf.org/
* https://images.cypat.guide
* https://www.hackthebox.com/

[[Category:Windows Forensics|001]]
[[Category:Migrated from cypat.guide]]

Draft:Introduction to Forensics - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/windows/forensics/intro_forensics.md