# Ctf Forensics

Provides digital forensics and signal analysis techniques for CTF challenges.

- Repository: https://github.com/ljagiello/ctf-skills (3598 stars)
- Category: Documents
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add ljagiello/ctf-skills --skill ctf-forensics -g -a claude-code -y`
Codex: `npx skills add ljagiello/ctf-skills --skill ctf-forensics -g -a codex -y`
Cursor: `npx skills add ljagiello/ctf-skills --skill ctf-forensics -g -a cursor -y`
Gemini CLI: `npx skills add ljagiello/ctf-skills --skill ctf-forensics -g -a gemini-cli -y`

## Description

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CTF Forensics & Blockchain

Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.

## Prerequisites

**Python packages (all platforms):**
```bash
pip install volatility3 Pillow numpy matplotlib scipy librosa scikit-learn opencv-python-headless pymongo impacket brotli exrex stegano heatshrink2
```

**Linux (apt):**
```bash
apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \
  ffmpeg steghide testdisk john pcapfix
```

**macOS (Homebrew):**
```bash
brew install binwalk exiftool wireshark sleuthkit ffmpeg \
  testdisk john-jumbo
```

**Ruby gems (all platforms):**
```bash
gem install zsteg
```

## Additional Resources

The rest: https://github.com/ljagiello/ctf-skills/blob/HEAD/ctf-forensics/SKILL.md