2HWA—منتخب القهوة

Forensics Writeups

Solutions, exploit walkthroughs, and challenge analysis in Forensics.

Cover image for CAT CTF 26 Finals — DFIR: Devs beginning
Forensics

CAT CTF 26 Finals — DFIR: Devs beginning

Walkthrough of the Devs beginning DFIR challenge at CAT CTF 26 Finals, analyzing FTK evidence, PowerShell history, and recovering DPAPI keys to access a...

dfirforensicsctfcat-ctfdpapimimikatz

@Y0un15 // CAT Reloaded CTF

Read →
Cover image for CAT CTF 26 Finals — DFIR: Nightjar (FINWKS07)
Forensics

CAT CTF 26 Finals — DFIR: Nightjar (FINWKS07)

Walkthrough of Operation Nightjar FINWKS07 DFIR challenge at CAT CTF 26 Finals, investigating endpoint triage artifacts, scheduled task persistence, binary...

dfirforensicsctfcat-ctfincident-responsetriagepersistence

@Y0un15 // CAT Reloaded CTF

Read →
Cover image for Silent Access
ForensicsCTF Challenge

Silent Access

Mahmoud left his workstation unlocked during a short break. While he was away, an insider accessed the machine and performed unauthorized activity. When he...

Digital ForensicsMemory ForensicsVolatilityInsider ThreatIncident ResponseEYCC CTF 2026beginner-friendly

@MAb0EL3TA // EYCC CTF 2026

Read →
Cover image for Trust Issue
ForensicsCTF Challenge

Trust Issue

Mahmoud was chatting with a colleague and asked them to send the required work files. With good intentions, he opened the received file, but shortly after, he...

Digital ForensicsDisk ForensicsPhishingLOLBinsPersistenceMITRE ATT&CKEYCC CTF 2026beginner-friendly

@MAb0EL3TA // EYCC CTF 2026

Read →
Cover image for ICMTC CTF 2026 Finals — DFIR: Infected
Forensics

ICMTC CTF 2026 Finals — DFIR: Infected

Walkthrough of the Infected ransomware memory forensics challenge at ICMTC Finals 2026, using Volatility 3 to extract malware artifacts, reversing Atac4D.dll,...

dfirforensicsctficmtc-ctfmemory-forensicsvolatilityransomware

@Y0un15 // ICMTC CTF

Read →
Cover image for ICMTC CTF 2026 Finals — DFIR: The Empire is at risk
Forensics

ICMTC CTF 2026 Finals — DFIR: The Empire is at risk

Walkthrough of The Empire is at risk challenge at ICMTC Finals 2026, analyzing network traffic and memory dumps to unpack PowerShell Empire C2 staging, decrypt...

dfirforensicsctficmtc-ctfnetwork-forensicspowershell-empirec2pcap

@Y0un15 // ICMTC CTF

Read →
Cover image for Secret Meeting | Zoom Forensics Challenge
Forensics

Secret Meeting | Zoom Forensics Challenge

An advanced DFIR analysis bridging disk and memory forensics to uncover hidden Zoom artifacts. This walkthrough details the step-by-step process of VSS...

Memory ForensicsWindows ForensicsZoom Forensics

@MAb0EL3TA // HTB Neurogrid CTF

Read →
Cover image for CYCTF 2025 Qualifications
Forensics

CYCTF 2025 Qualifications

Write-up for DFIR challenges Hidden In PlainSight and DokDok in CyShield CTF 2025 Qualifications.

ctfdfirforensicscyctf

@medohasabo13 // CyCTF

Read →
Cover image for CONCTF 2025 Qualifications
Forensics

CONCTF 2025 Qualifications

Write-up for DFIR challenges Deep Trace, Silent Sleeper, and Locked Out in Connectors CTF 2025 Qualifications.

ctfdfirforensicsconctf

@medohasabo13 // Connectors CTF

Read →
Cover image for CAT CTF 25 DFIR Write-up
Forensics

CAT CTF 25 DFIR Write-up

Hey folks, Today, we’ll be walking through the Forensics challenges I’ve tackled at CAT CTF 25, Insha’allah.

ctf-walkthroughdigital-forensicsdfirctf

@OG13 // CAT CTF

Read →
Cover image for L3akCTF 2025 Forensics Write-up
Forensics

L3akCTF 2025 Forensics Write-up

Hey folks, Today, we’ll be walking through the Forensics challenges I’ve tackled in L3akCTF 2025, Insha’allah.

ctfdigital-forensicsctf-walkthroughdfir

@OG13 // L3ak CTF

Read →