Draft:Introduction to Forensics
This draft is ready for review. If you're the author, click below to notify a reviewer. A reviewer will check it for structure, sourcing, and accuracy. You may continue editing while you wait.Request reviewApprove draftReject draft
Author(s): a_person
Last Updated: 05-30-2026
| Recommended Prerequisites (click to expand) |
|---|
|
None |
Digital Forensics
Think about a physical crime scene. An investigator would examine the scene, look for evidence, document their findings, and reconstruct what happened. Digital forensics is very similar. Instead of physical evidence, forensic analysts investigate logs, file systems, network traffic, and other artifacts to:
- identify evidence
- reconstruct exactly what happened
- determine the cause of an incident
- support legal investigations
Digital forensics is also a vital part of incident response (IR), which is the process an organization uses to detect, respond to, and recover from cyberattacks.
What are forensics questions?
Forensics Questions are questions that ask about the current system, logs of attacks, or general information that has some relationship to the current system. These can ask you anything from CVEs, using logs to find indicators of compromise, or reversing a binary. They can also include file attachments which include, but are not limited to: network captures, images, and malware. They are usually located on the Desktop.
Practice!
Here are some example, easy forensics questions that do not require much work:
| Find the CVEs fixed in Notepad++ v8.5.7 |
|---|
|
Fixed CVEs: CVE-2023-40031, CVE-2023-40036, CVE-2023-40164, CVE-2023-40166 |
Decode the encrypted message: 5a 47 39 75 61 32 56 35 49 47 6c 7a 49 47 35 76 64 43 42 7a 61 32 6c 69 61 57 52 70
|
|---|
|
Decoded: donkey is not skibidi You can decode it by decoding from hex, then decoding the result from Base64. Cyberchef link: https://cyberchef.org/#recipe=From_Hex('Auto')From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=NWEgNDcgMzkgNzUgNjEgMzIgNTYgMzUgNDkgNDcgNmMgN2EgNDkgNDcgMzUgNzYgNjQgNDMgNDIgN2EgNjEgMzIgNmMgNjkgNjEgNTcgNTIgNzA |
| What is the publication timestamp (ISO 8601) for CVE-2025-4561? |
|---|
|
Timestamp: 2025-05-12T06:44:29.959Z |
Here is an example of conducting forensics on Windows Event Logs. This was a scrapped challange for a CTF. You may want to do some research if you are not familiar with them.
Click here to download the file
| Find the following information: the executable file downloaded and ran that was the malware, the name of the executable that abused an unquoted service path, the sensitive file that was accessed, the command that led the attacker to discover it, the registry value created for persistence of the PowerShell script uploading user data, and the FTP server port number. |
|---|
|
Answers:
|
What can I use for extra practice?
CTFs, practice images, and Hack the Box are great for forensics practice. Here are some websites you can use to practice them: