Recently, I had the opportunity to create two DFIR challenges for the EYCC CTF.

This one is a Windows Memory Forensics challenge that I intentionally made it easier than the Quals challenge. The main goal was to introduce participants to Volatility 2 & 3 and helping them understand how different plugins can be used to extract useful evidence from a memory dump.

Secret Meeting zoom forensics challenge write-up.

Three DFIR solves from HTB Neurogrid, focused on artifact triage and attack-chain reconstruction.

A DFIR write-up from CyCTF 2025 Quals covering Windows artefacts, persistence, and execution traces.

A set of DFIR challenge notes from CAT Reloaded CTF 2025.

OSINT challenge notes from the Global Cyber Skills Benchmark CTF 2025.

OSINT solutions from Cyber Apocalypse CTF 2025 with a focus on attribution and public-source correlation.