← All Challenges

Departing Engineer

Forensics 100 pts standard
Challenge Description

A senior engineer resigned and is suspected of stealing proprietary CAD documents in the final week before offboarding.

Determine :

  1. True exfiltration channel combination.
  2. User account.
  3. Stolen archive short SHA1.
  4. USB serial used in physical transfer.

Flag format: HackCTF{...}

Files
↓ archive_metadata.txt ↓ cloud_sync.log ↓ decoy_exports.log ↓ edr_events.json ↓ mixed_case_telemetry.log ↓ noise.log ↓ noise_expanded.log ↓ usbstor.log
Hints
View Hint : Hint
  1. Timeline correlation beats single-source evidence.
  2. One export log file is intentionally noisy.
  3. USB serial is required in lowercase in the flag.
Submit Flag

Login to submit a flag.