# Pentest Ctf Forensics

> Digital forensics, steganography, and packet analysis for CTF challenges and investigation.

- Skill: `jd-opensource/pentest-ctf-forensics` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add jd-opensource/pentest-ctf-forensics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jd-opensource/pentest-ctf-forensics/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jd-opensource (https://skillmd.com/u/jd-opensource)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jd-opensource/pentest-ctf-forensics

---


# Pentest CTF Forensics

## Purpose
Extract hidden information from various artifacts: memory dumps, network captures (PCAP), images, and disk images.

## Core Workflow
1. **File Analysis**: Identify file type, metadata, and embedded strings using `file`, `exiftool`, and `strings`.
2. **Steganography**: Detect and extract hidden data in images/audio using `steghide` and `stegsolve`.
3. **Network Forensics**: Analyze PCAP files for suspicious traffic and flag transmission using `wireshark` or `tshark`.
4. **Memory Forensics**: Analyze memory dumps for processes, connections, and injected code using `volatility`.
5. **Data Extraction**: Carve files and recover deleted data using `foremost` and `binwalk`.

## References
- `references/tools.md`
- `references/workflows.md`