ctf-forensics

# CTF Forensics & Blockchain Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details. ## Prerequisites **Python packages (all platforms):** ```bash pip install volatility3 Pillow numpy matplotlib ``` **Linux (apt):** ```bash apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \ ffmpeg steghide testdisk john pcapfix ``` **macOS (Homebrew):** ```bash brew install binwalk exiftool wireshark sleuthkit ffmpeg \ testdisk john-jumbo ``` **Ruby gems (all platforms):** ```bash gem install zsteg ``` ## Additional Resources - [3d-printing.md](3d-printing.md) - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink) - [windows.md](windows.md) - Windows forensics (registry, SAM, event logs, recycle bin, NTFS alternate data streams, USN journal, PowerShell history, Defender MPLog, WMI persistence, Amcache) - [network.md](network.md) - Network forensics basics (tcpdump, TLS/SSL keylog decryption, TLS master key extraction from coredump, Wireshark, PCAP, port scanning, SMB3 decryption, 5G/NR protocols, WordPress recon, credentials, USB HID steno, BCD encoding, HTTP file upload exfiltration, split archive reassembly via timestamp ordering) - [network-advanced.md](network-advanced.md) - Advanced network forensics (packet interval timing encoding, USB HID mouse/pen drawing recovery, NTLMv2 hash cracking, TCP flag covert channel, DNS last-byte steganography, DNS trailing byte binary encoding...