Find hidden flags in digital evidence files.
What it does
Guides analysis of CTF evidence to recover hidden data, deleted files, and credentials.
When to use it
Use when investigating forensic CTF artifacts such as disk images, memory dumps, logs, network captures, or steganography.
How to use it
Give it forensic CTF evidence files; it analyzes them for hidden information, recoverable files, and credentials.
What you provide
- Your files
Uses
Good to know
- cannot be undone: disk.img; broken.xz
Latest review
What you need · 7
Requires Python 3.
Lists volatility3 among the Python packages to install before analysis.
Access · 8
This skill
disk.img
Write
Repairs the evidence filesystem (irreversible)
broken.xz
Write
Overwrites the damaged archive header (irreversible)