⌕   KNOWLEDGE AREA

Forensics & steganography

Reconstruct evidence from files, memory, and hidden data.

8 topics

Forensicsintermediate

Archives and document containers as evidence

Office documents, application packages, and many media formats are structured containers.

archives-and-documentsforensics
Forensicsfoundation

Evidence triage, hashes, and reproducible artifact handling

Forensic analysis starts with preserving the artifact and its provenance.

evidence-triageforensics
Forensicsintermediate

File carving and validating embedded formats

Carving recovers candidate files from recognizable structures inside a larger byte stream.

file-carvingforensics
Forensicsintermediate

Filesystem artifacts, deleted entries, and allocation state

Filesystem metadata connects names, timestamps, permissions, and allocation records to stored bytes.

filesystem-artifactsforensics
Forensicsintermediate

Image and audio steganography: channels and extraction hypotheses

Steganography hides data within another representation rather than necessarily encrypting it.

image-and-audio-steganographyforensics
Forensicsintermediate

Logs and timelines: event meaning before chronology

Timeline analysis combines events whose clocks, timestamp formats, and meanings differ.

logs-and-timelinesforensics
Forensicsintermediate

Memory forensics and plugin assumptions

A memory image contains process state, mappings, handles, and potentially transient data absent from disk.

memory-forensicsforensics
Forensicsintermediate

Packet captures: streams, time, and reconstruction

A packet capture records observations at one network point, not an omniscient view of an application exchange.

packet-capture-analysisforensics