2019 Unofficial Defcon DFIR CTF

2019 Unofficial Defcon DFIR CTF

Hello Reader,
       It's that time again! First of all here is the important things you came here for:

1. Link to download this years images:


This year Champlain College's Digital Forensic Association saved the

day by providing a CTF they hadn't released to the general public. Matt and I have been a little busy with the whole changing our lives into KPMG thing so without them there would be no CTF this year.

1st. DFIR Netwars Continuous from SANS  (to last years winner I'm going to get yours resolved)
2nd. Magnet Forensics Prize Pack
3rd.Write Blocker and a copy of Eoghan Casey's Cybercrime book donated by BriMor Labs

The contest starts TODAY 8/9/2019 for those onsite at Defcon. You must be present to win.

The contest ends Sunday at 10am PST at which point we will notify winners.


  1. hey, I'm not sure if I missed something, but the memory image provided doesn't seem to correspond to the ctf questions for the Memory Forensics section. I get "incorrect" for the Sha1 hash, profile, PID of notepad.exe even though I'm looking right at these values.

  2. never mind, I misunderstood how to submit the flags. so confusing...

  3. CTF site is down?