Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer
Forensicsmedium200 pts0 solves

Carve It

Investigators recovered a single blob from a suspect USB stick. The extension says .bin, but it behaves like more than one file.

Learning objectives

Identify file signatures (magic bytes) and carve embedded files from a blob.

Instructions

Analyse evidence.bin. Find the second file hidden after the first one and read its contents.

Prerequisites: Hex viewer or binwalk; basic understanding of file formats.
Flag format: cspk{...}
Files: evidence.bin (0.6 KB) (download after registering)
Useful tools: Binwalk
Register to play

References

Write-up

The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.

More forensics challenges

Metadata Detective