Forensics II (Networking & Disk Forensics) [Lect 6: Competitive Cybersecurity 101]

This session expands the forensic toolkit into network traffic analysis and disk imaging, emphasizing the golden rule of always analyzing bit-for-bit copies rather than original evidence. Students master Wireshark to filter millions of packets, intercept data exfiltration, and extract hidden files directly from HTTP traffic. The lecture also debunks the "deleted file" myth by exploring unallocated space and teaching file carving techniques using command-line tools and the Autopsy GUI to recover wiped evidence.

1. Competitive Cybersecurity 101 Session 6: Forensics II (Networking & Disk Forensics) Kannan Murugapandian August 14, 2026 Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 1 / 16
2. Disclaimer & Ethical Rules Strictly for Educational Purposes All knowledge and tools must only be applied in environments where you have explicit permission. Do not test on systems you do not personally own or lack authorization to assess. Unauthorized access constitutes a criminal offense under the Computer Misuse Act. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 2 / 16
3. Today’s Agenda Network Forensics: PCAPs & Wireshark Traffic Analysis: Filtering & File Extraction Disk Forensics: Images & File Systems The ”Deleted” Myth: Unallocated Space Hands-On: The Intercepted Chat & The Wiped Drive Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 3 / 16
4. What is Network Forensics? The Concept: Capturing and analyzing network traffic to find evidence of data theft or malware. The Medium: PCAP (Packet Capture) files. It is like a security camera recording, but for data instead of video. CTF Reality: Flags are often hidden inside specific network requests or downloaded files. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 4 / 16
5. Wireshark: The Industry Standard The Tool: The world’s most popular network protocol analyzer. The 3-Pane Layout: Top: List of individual packets. Middle: Protocol tree breakdown of the selected packet. Bottom: Raw hex and ASCII bytes. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 5 / 16
6. Wireshark Filters (The ”Why”) The Problem: A 5-minute PCAP can contain millions of packets. Finding the flag manually is impossible. The Solution: Display Filters. We tell Wireshark to hide the noise and only show us the traffic we care about. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 6 / 16
7. Wireshark Filters (The Syntax) # Filter by specific IP address ip . addr == 192.168.1.10 # Show only web traffic http # Find DNS queries ( often used for data exfiltration ) dns # Find specific text inside a packet frame contains " flag " Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 7 / 16
8. Extracting Files from Traffic The Concept: Hackers often steal data by downloading files over HTTP, FTP, or SMB. The Tool: Wireshark Export Objects Menu Path: File → Export Objects → HTTP. Wireshark will automatically reassemble the packets and let you save the downloaded files to your disk! Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 8 / 16
9. Disk Forensics (The ”Why”) The Concept: Analyzing the physical or digital storage media (Hard drives, USBs, SD cards). The Goal: Reconstructing past events. What did the user do? What did they try to hide? The Golden Rule: Never analyze the original evidence drive! Always work on a perfect copy. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 9 / 16
10. Disk Images (Bit-by-Bit Copies) The Concept: A Disk Image (like .dd or .E01) is an exact, bit-for-bit replica of a drive. Why not just copy-paste the files? Copy-pasting changes timestamps and misses hidden/deleted data. A disk image captures everything, including the empty space. Integrity: We use hashes (SHA-256) to prove the image hasn’t been altered. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 10 / 16
11. The ”Deleted” File Myth The Concept: Unallocated Space When you ”delete” a file and empty the Recycle Bin, the OS does not erase the data. It simply removes the file’s name from the directory index and marks the space as ”available” for future use. The Analogy: It is like tearing a card out of a library’s index catalog, but leaving the actual book on the shelf! Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 11 / 16
12. File Carving The Concept: Recovering files from unallocated space without relying on the file system’s index. How it works: Tools scan the raw hex data looking for Magic Bytes (File Signatures). If it sees FF D8 FF, it knows a JPEG image starts there and extracts it. The Tool: binwalk or foremost (Command line), or Autopsy (GUI). Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 12 / 16
13. Autopsy: The Forensic GUI The Tool: The premier open-source digital forensics platform. Why it dominates CTFs: Visual Timeline: See exactly what the user was doing minute-by-minute. Keyword Search: Instantly grep the entire hard drive for ”flag” or ”password”. Web Artifacts: Automatically extracts deleted browser history and cookies. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 13 / 16
14. Mini Challenge: The Wiped Drive Scenario: A suspect claims they ”deleted” the flag and emptied the trash. You are given suspect usb.dd. Your Tasks: 1 Load the disk image into Autopsy. 2 Navigate to the ”Unallocated Space” or use the ”File Carving” module. 3 Search for deleted text files or images containing the flag string! Practice on the course hub: kannan.bearblog.dev/ctf-dps/ Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 14 / 16
15. Key Takeaways PCAPs: Use Wireshark filters to cut through millions of packets and export hidden objects. Disk Images: Always analyze a bit-by-bit copy, never the original evidence. Deletion is a Myth: ”Deleted” files live in unallocated space until overwritten. Autopsy: Master keyword searches and file carving to easily recover hidden flags. Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 15 / 16
16. Thank You! Questions? Email: kannan.mp@proton.me Course Hub: kannan.bearblog.dev/ctf-dps/ Next Session: Web Exploitation I (Client-Side Attacks) August 21, 2026 Kannan Murugapandian Competitive Cybersecurity 101 August 14, 2026 16 / 16