Biterra Labs preview / Forensics Basics
Different artefacts answer different questions. Once you can identify a file and read what is on it, the remaining skill is using that to pick the next object.
| Artefact | Useful question | First tools |
|---|---|---|
| Image | Does it contain metadata, comments, or bytes beyond the image? | file, exiftool, strings |
| PDF or DOCX | Who created it, and what names or properties remain? | pdfinfo, exiftool, unzip -l |
| Log | Who did what, to which object, and in what order? | less, grep |
| Archive | Which files and stored dates does the container hold? | tar -tzf, unzip -l |
You do not need to master each format. You need to know which kind of question each one is likely to answer.
CTF clues rarely name the tool. They usually point at something the visible file has forgotten to hide:
| A challenge might say | It may be pointing at | First check |
|---|---|---|
| “The poster was cleaned up, but the printer remembers the draft.” | An old filename, author, or export program in image metadata | exiftool poster.jpg |
| “The picture ends before the secret does.” | Data appended after the normal end of an image | file, strings, then a hex viewer |
| “The logo scales nicely. Read between the lines.” | Text, comments, or hidden elements in an SVG | Open the SVG in a text editor |
| “This is the final report. At least, that is what the page says.” | A different title, author, or earlier name in PDF/DOCX properties | pdfinfo, exiftool, or docProps/core.xml |
| “The comment was resolved, not forgotten.” | Comments still stored inside a DOCX package | Inspect word/comments.xml |
| “The badge was used after its owner clocked out.” | Two log events that only become useful when compared by user and time | Search the username or badge ID in the log |
| “The backup is newer than the file inside it.” | Different dates for the archive and one of its members | List the archive before extracting it |
Treat these as directions, not proof. A clue should tell you what to inspect next; the file still has to support the answer.
If a challenge keeps talking about a camera, printer, draft, crop, or export, inspect the image file as well as opening it. Source-readable formats such as SVG are also worth opening as text.
$ exiftool poster.jpg | grep -E 'Artist|Document Name|Software'
Artist : design-intern
Document Name : poster-draft.jpg
Software : LobbyPrinter 4.0
The visible poster may look finished while its metadata still points to the draft and the tool that exported it.
Document clues often play on the gap between what the page says and what the file remembers: “final,” “anonymous,” “no comments,” or “written today.” Check those claims against the stored properties.
$ pdfinfo handover.pdf | grep -E 'Title|Author|Creator'
Title: Final Handover
Author: night-supervisor
Creator: Microsoft Word
A DOCX is a ZIP package of XML files. unzip -p report.docx docProps/core.xml reads its core properties without opening Word.
Log clues usually name one thing indirectly: a username, badge, room, filename, IP address, or minute. Search for that anchor, then read the lines around each match.
If a log says:
08:10 uploaded file08:11 renamed file08:12 exported imagethen the timeline tells you what to inspect next.
Other common prompts are “Who was still in the building?”, “Which file was renamed?”, and “What happened immediately before the failed login?” Each gives you a subject and a relationship to look for instead of asking you to read every line.
See what the bundle contains before extracting it:
$ tar -tzf night_desk.tar.gz
night_desk/draft-note.txt
night_desk/poster.jpg
night_desk/activity.logThere are three different sources: a note, an image, and a log. Start with the shortest readable file.
$ tar -xzf night_desk.tar.gz
$ cd night_desk
$ cat draft-note.txt
final export after cleanup
“Final export” and “cleanup” suggest that poster.jpg was made from an earlier version. Now find when that happened.
$ grep -E 'draft-note|poster' activity.log
09:03 edited draft-note.txt
09:05 exported poster.jpg
The note was edited two minutes before the poster was exported. That gives you a specific question for the image: did the export leave anything from the draft behind?
$ exiftool poster.jpg | grep -E 'Document Name|Image Description'
Document Name : poster-draft.jpg
Image Description : locker 314 before cleanup
The visible poster is not the answer. Its metadata preserves the earlier filename and the detail removed during cleanup.
That is the habit: one artefact should change the question you ask of the next one.
A challenge gives you these three findings:
badge.jpg metadata: Image Description = visitor badge B-042
note.txt: spare key moved to locker 314
access.log: 22:14 badge B-042 opened locker 314
The visitor's authorised access ended at 22:00. What can you conclude, and which files support it?
Answer: badge B-042 opened the locker containing the spare key at 22:14, fourteen minutes after its access should have ended. The image identifies the badge, the note explains why locker 314 matters, and the log connects both at a specific time. You cannot conclude who physically held the badge.
pdfinfoNext challenge: Dunder Mifflin Desk Audit
Identify the files, then let the cheapest readable one name the subject.