Run ExifTool on the photos and videos. Look for GPS coordinates, camera serial numbers, or "Software" tags that might indicate editing or hidden payloads.
Inspect images for hidden data using tools like StegSolve or steghide . Check for "Least Significant Bit" (LSB) manipulation.
Use binwalk or foremost to see if other files are embedded inside the media files (e.g., a .zip hidden inside a .jpg ).
List the top-level folders or files found upon opening (e.g., IMG_001.jpg , Vacation_Video.mp4 , secret.zip ). 3. Technical Analysis Detailed steps taken during the investigation:
A summary of the results. For a CTF, this would be the final or the answer to the challenge prompt.
Description of the second discovery (e.g., "GPS coordinates in IMG_002 led to a specific physical location"). 5. Conclusion
Below is a structured template for a based on standard industry practices for analyzing such archives. Forensic Investigation Write-Up 1. Case Overview Evidence Name: PhotosAndVideos1-3.7z File Type: 7-Zip Compressed Archive
Run ExifTool on the photos and videos. Look for GPS coordinates, camera serial numbers, or "Software" tags that might indicate editing or hidden payloads.
Inspect images for hidden data using tools like StegSolve or steghide . Check for "Least Significant Bit" (LSB) manipulation. PhotosAndVideos1-3.7z
Use binwalk or foremost to see if other files are embedded inside the media files (e.g., a .zip hidden inside a .jpg ). Run ExifTool on the photos and videos
List the top-level folders or files found upon opening (e.g., IMG_001.jpg , Vacation_Video.mp4 , secret.zip ). 3. Technical Analysis Detailed steps taken during the investigation: Check for "Least Significant Bit" (LSB) manipulation
A summary of the results. For a CTF, this would be the final or the answer to the challenge prompt.
Description of the second discovery (e.g., "GPS coordinates in IMG_002 led to a specific physical location"). 5. Conclusion
Below is a structured template for a based on standard industry practices for analyzing such archives. Forensic Investigation Write-Up 1. Case Overview Evidence Name: PhotosAndVideos1-3.7z File Type: 7-Zip Compressed Archive