Last updated Mar 9, 2023 Edit Source

So you are looking at some piece of evidence. Evidence could be anything from a website, to an image, to even simply a piece of text. With forensics, it is all about asking the right questions and looking for the answers. For example, lets take a look at this piece of text:

aGFoYSB5b3UgZm91bmQgbWUh

Looks pretty weird right? If you didn’t know what you were looking at, it can be pretty confusing. Luckily, there are tools that exist that can help us get some ideas quickly. CyberChef is a great tool and in this case helps us out! We can drag and drop different filters to discover that this text was encoded with Base64.

haha you found me!

• Are there patterns to the characters that I am looking at?
  • Common text encoding formats

• What metadata exists on the image?
  • Author
  • GPS Coordinates
• Is there any content hidden inside of the image as text?
• Can I do a reverse image search to find the original image?
• Could there be steganography hidden in the image?