Root-Me DFIR challenges¶

What is it?¶

CTF-style forensic puzzles (PCAPs, logs, disk images) with a focus on technical precision.

Why play?¶

• No fluff: Straight to the forensic nuggets.

• Brutal feedback: Solutions demand exact answers.

• Tool flexibility: Use any method that works.

Classic challenge:

“This USB dump shows file deletions—recover the secret message.”

How do them?¶

• Command & Control level 2

• Docker layers

• Log analysis web attack

• Command & Control level 5

• Find the cat

• Ugly duckling

• Command & Control level 3

• Open my vault

• Command & Control level 4

• Job interview

• Command & Control level 6

• Second job interview