Back to Playbooks
CTF
ctf-forensics-disk-memory
CTF disk and memory forensics. Volatility 3 process/network/MFT analysis, disk imaging with Sleuth Kit icat, VM forensics OVA/VMDK via 7z, vmss2core snapshot conversion, ransomware AES key oracle, RAID 5 XOR recovery, APFS/ZFS snapshot reversion, WordPerfect macro brute, Docker layer secrets, PowerS
Slug
ctf-forensics-disk-memory
Category
CTF
Run Playbook
/gitest ctf-forensics-disk-memory