DFIR CTF Academy
Digital Forensics Assessment Platform
Basic–Intermediate
Operation: Silent Exit
DFIR CTF — Digital Forensics Assessment
NovaTech Solutions Insider Threat Investigation  ·  DFIR CTF Academy
25
Questions
45 min
Duration
60%
Pass mark
Active
Anti-cheat
Case scenario

NovaTech Solutions, Austin, Texas. Senior developer Alex Mercer resigned on 14 March 2024. Days later, a competitor released a product suspiciously similar to NovaTech's unreleased software. IT Security imaged his workstation NOVATECH-WS042 (Windows 10 Pro) and collected browser artifacts, registry hives, and event logs. You are the assigned forensic analyst. All questions are based on this investigation.

Topics covered
DF Fundamentals Evidence Acquisition Chain of Custody File Systems & NTFS Windows Artifacts Registry Forensics Browser Forensics Event Logs Timeline Analysis Reporting FTK Imager Autopsy EZ Tools
Exam rules — read before starting
  • 25 questions drawn randomly from a 60-question bank  ·  1 mark each  ·  no negative marking
  • 45 minutes  ·  timer starts the moment you click Begin
  • Tab or window switching = violation  ·  3 violations triggers auto-submit
  • Right-click and copy/paste are disabled during the exam
  • One email = one attempt  ·  no retakes
  • Questions and answer options are randomised for every session
  • Your submission is recorded and sent to your instructor automatically

Please enter a valid email address.