# Forensics Intro

### What is Digital Forensics?
Digital forensics is the science of recovering and analyzing digital data to uncover what happened during a cyber incident.

It’s used to:
- Investigate cybercrimes, data breaches, and system intrusions.
- Reconstruct events from collected digital evidence.

In CTFs, forensics challenges often involve analyzing files, packets, or images to find hidden messages, metadata, or clues.

---

### Types of Digital Forensics
There are several branches of digital forensics, each focusing on different sources of evidence:

| Type | Description |
|------|--------------|
| Computer Forensics | Analyzing data from computers, hard drives, and removable storage devices. |
| Network Forensics | Monitoring and analyzing network traffic to detect suspicious activity. |
| Mobile Forensics | Extracting and examining data from mobile devices like smartphones and tablets. |
| Cloud Forensics | Investigating data stored in cloud-based environments. |

Each type uses specialized tools and techniques depending on the data source being analyzed.

---

### Image Forensics & Steganography
Steganography is the practice of hiding data within other files, such as images or audio.
In CTFs, steganography challenges often require you to extract hidden information or flags from image files.

**Common Tools:**
- steghide: hides and extracts data from JPEG, BMP, WAV, and AU files.
- zsteg: detects Least Significant Bit (LSB) steganography in PNG and BMP images.
- ExifTool: extracts metadata from files and can reveal hidden information like comments, GPS data, or camera info.

*Tip:* Always check metadata first; flags are often hidden in image metadata fields.

---

### PCAP Analysis & Network Forensics
**PCAP files** (Packet Capture files) record raw network traffic and are used to analyze communications between systems.

**Tools:**
- Wireshark: GUI-based packet analyzer for viewing and filtering network traffic.
- TShark: command-line version of Wireshark.
- tcpdump: captures packets directly from the command line.

**Techniques:**
- Filter traffic by protocol, IP address, or keyword (e.g., `http`, `ftp`, `flag`).
- Reconstruct HTTP sessions to extract transmitted files, credentials, or hidden data.

*In CTFs, flags often appear in HTTP traffic or inside transferred files within PCAPs.*

---

### Disk Imaging & Analysis
Disk imaging involves creating an exact copy of a storage device for examination without altering the original data.

**Tools:**
- dd: command-line tool for making raw disk copies.
- Guymager: GUI-based disk imaging tool.
- Autopsy: a powerful forensic suite for analyzing disk images and recovering deleted files.

**Techniques:**
- Create write-blocked images to preserve evidence integrity.
- Analyze file systems, recover deleted data, and examine user activity.

---

### Useful Linux Commands for Forensics
Linux utilities are extremely valuable in forensics investigations and CTF challenges.

| Command | Function |
|----------|-----------|
| `strings` | Extracts human-readable text from binary files. |
| `grep` | Searches for patterns or keywords within files. |
| `find` | Locates files by name, type, or size. |
| `netstat` | Displays active network connections and open ports. |
| `ps` | Lists currently running processes. |

*Example:*
`strings dump.bin | grep flag{` searches a binary file for flag patterns.

---

### Tools & Resources
**Tools:**
- binwalk: extracts embedded files or firmware components.
- zsteg: detects LSB steganography in images.
- Wireshark: inspects network traffic and protocols.
- ExifTool: extracts and analyzes file metadata.

**Resources:**
- [CTF101 Forensics Guide](https://ctf101.org/forensics/overview)
- [TryHackMe Digital Forensics](https://tryhackme.com/module/digital-forensics-and-incident-response)
- [Hack The Box Academy](https://academy.hackthebox.com/course/preview/introduction-to-digital-forensics)

---

### Conclusion
Forensics is about investigation and reconstruction; uncovering what’s hidden and understanding how it got there.
Whether you’re analyzing packets, disk images, or pictures, every byte can tell a story.
Practice with CTF challenges, explore new tools, and keep digging deeper!