1. Preserve the original
Work on a copy and keep the supplied file unchanged. Record its original name, size, acquisition source, and SHA-256 digest. A digest lets you demonstrate that later observations refer to the same bytes, even if you rename the working copy.
For unknown files, use an isolated analysis environment. Do not execute binaries, enable macros, or open active content on a production machine merely to see what happens.
2. Identify the actual format
Extensions are labels, not evidence. Compare the first bytes with known magic values and inspect the broader structure. A file named notes.txt can still begin with the ZIP signature 50 4B 03 04. A PNG begins with 89 50 4E 47 0D 0A 1A 0A.
| Question | Evidence |
|---|---|
| What does the name claim? | Extension and MIME label |
| What do the bytes claim? | Header, footer, container structure |
| Is content appended? | Unexpected data after a valid end marker |
3. Inspect metadata before extraction
Metadata can reveal timestamps, software names, dimensions, authors, comments, archive members, and path information. Record useful fields before altering the file. Treat timestamps as clues rather than absolute truth: they may use different time zones or may have been modified.
4. Search for readable strings
Strings can expose URLs, filenames, flags, commands, embedded JSON, or error messages. Search both ASCII and UTF-16 where appropriate. Context matters: a visible string may be unused data, a decoy, or part of a compressed member.
5. Extract in controlled stages
If the file is an archive or container, list members before extracting. Watch for absolute paths, parent-directory traversal, duplicate names, huge expanded sizes, and nested archives. Extract into a dedicated directory and hash important outputs. When carving embedded content, record offsets and the command or tool used.
“Bytes at offset 0 match a PNG header” is an observation. “This is definitely an unmodified screenshot” is an interpretation that requires additional evidence.
Example investigation record
source: challenge download
original: evidence.bin
size: 18,442 bytes
sha256: <recorded digest>
header: 50 4b 03 04 (ZIP)
members: note.txt, image.png
next step: extract to a clean directory and hash both membersCommon mistakes
Opening before hashing
Some applications update metadata, thumbnails, or recent-file records. Hash first, then work from a copy.
Trusting only one identification tool
Magic databases can be incomplete and polyglot files may satisfy more than one parser. Compare multiple signals and inspect boundaries.
Losing the chain of actions
A correct flag without reproducible steps is difficult to review. Store commands, offsets, intermediate hashes, and conclusions in the challenge workspace.
Compact checklist
- Copy and hash the original.
- Record name, size, source, and timestamps.
- Compare extension, MIME information, and signature.
- Inspect metadata and strings.
- List container contents before extraction.
- Extract or carve in stages and hash outputs.
- Document findings and remaining hypotheses.
This workflow is intended for files you own or are authorized to inspect, including CTF and training material.