SK-CERT CyberGame 2026: Forensics Challenges Writeup
A complete walkthrough of the SK-CERT CyberGame 2026 forensics category, covering four distinct investigations. The Telemetry challenge decodes a flag geographically encoded in a MAVLink 2.0 drone flight path hidden among honeytoken decoys. The Volatile Incident series tackles a 4.4 GB Linux ELF memory dump - first with a fast strings triage to recover bash history flags, then with a full Volatility 3 setup using a custom dwarf2json symbol table to identify a root-level Python packet sniffer persisted via nohup. The final Windows disk forensics challenge reconstructs a social engineering attack through AD1 image analysis, Chrome and Edge browser history, Outlook OST email parsing, Windows Registry UserAssist, and a password recovered from a public Steam profile - culminating in decryption of an exfiltrated 7zAES-encrypted archive.
May 13, 2026