Digital Forensics
Overview
Section titled “Overview”Digital forensics focuses on evidence collection and analysis from compromised systems. You will be given disk images, memory dumps, log files, and network captures to analyse and extract flags, IOCs, and attack timelines.
Duration: 4 hours
Typical marks distribution:
- Disk forensics: 35-40%
- Log analysis: 25-30%
- Memory forensics: 20-25%
- Network forensics: 10-15%
What You’ll Face
Section titled “What You’ll Face”Disk Forensics
Section titled “Disk Forensics”- Extract deleted files from forensic images
- Analyse file system artifacts (MFT, journal)
- Recover documents, images, encrypted data
- Browser history and artifact extraction
- File carving from unallocated space
Memory Forensics
Section titled “Memory Forensics”- Identify running processes and connections
- Detect process injection and rootkits
- Extract credentials from memory
- Analyse malware in memory dumps
- Find command-line history
Log Analysis
Section titled “Log Analysis”- Windows Event Log parsing (Security, System, Application)
- Linux syslog/auth.log analysis
- IIS/Apache access log correlation
- Firewall log analysis
- SIEM log correlation (national+)
Network Forensics
Section titled “Network Forensics”- PCAP analysis with Wireshark
- Identify C2 traffic patterns
- Extract files from network captures
- Detect data exfiltration
- Protocol analysis
Competition Strategy
Section titled “Competition Strategy”Time allocation:
- Disk forensics: 90 minutes (highest marks)
- Log analysis: 60 minutes
- Memory forensics: 50 minutes
- Network forensics: 20 minutes
Common pitfalls:
- Not reading the question properly (looking for wrong artifact)
- Spending too long on memory forensics (can be very time-consuming)
- Missing quick wins (deleted file recovery with Autopsy)
- Poor timeline documentation (must show timestamps)
Topics (Canonical Content)
Section titled “Topics (Canonical Content)”Content is being developed. Planned topics:
- Disk Forensics - Autopsy, FTK, file carving, filesystem analysis
- Memory Forensics - Volatility, process analysis, malware detection
- Log Analysis - Windows Event Logs, syslog, web server logs
- Network Forensics - Wireshark, PCAP analysis, protocol analysis
- Windows Artifacts - Registry, Prefetch, UserAssist, ShimCache
Competency by Level
Section titled “Competency by Level”| Regional | National | International |
|---|---|---|
| Extract deleted files (Autopsy) | File carving from slack space | Advanced filesystem artifact analysis |
| Basic Event Log filtering | Multi-source log correlation | SIEM query language mastery |
| Find processes (pslist) | Detect process injection | Rootkit detection and analysis |
| Basic PCAP filtering | Extract files from PCAPs | Advanced protocol analysis |
Practice Resources
Section titled “Practice Resources”Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.