CYBERFORENSICS
// OS
Someone inside the company emptied a server. You get a terminal, a pile of logs and five to eight suspects. Work out who did it, how, and why, then prove it.
[ LAUNCH TERMINAL -> /play ][ DAILY OPERATION ]
Free, in your browser, no ads. Play as a guest or keep your progress in the cloud with just a username and password.
How it works
- 100 % deductive casesEvery case is built backwards from its culprit. Three independent facts (who was on duty, who may use the stolen token, whose laptop it was) single out exactly one suspect. The tests prove it for 50 seeds. Nothing is a coin flip.
- Virtual network and CLI forensicsscan, connect, grep, find, diff, ps and kill on fictional servers full of believable logs, mailboxes and HR files. Chain commands with pipes, finish them with Tab. On harder cases a rogue process races to scrub the logs.
- Evidence correlation and crackingPin the lines that matter, line up timestamps across hosts and open the encrypted token registry: find the passphrase in the mail by hand, or buy a dictionary cracker.
- Black-market upgradesPayouts buy tools: an auto-highlighter, a deep port scanner, three cracker tiers and a log correlator. Reputation lifts your rank and unlocks achievements.
- SQL journals, RAM dumps, interrogationEvery constraint can be proven in more than one way: badge swipes and deleted SQL rows, kernel crash images, or a suspect cracking under the evidence you show them. A network map redraws the attacker's path from what you pin.
- APT-404 campaign and daily operationSolved cases earn Syndicate Intel that unlocks three boss operations, and every UTC day brings one shared tier III case for everybody.
Sample dossier: three clues, one name
A fictional excerpt. Each clue alone leaves several people standing; only the combination of all three is unique.
Marta Novak
mnovak
DevOps Engineer · Engineering
3C:52:82:11:9A:4E
Shortlisted: passes all three clues
Clue A · firewall.log on fw-edge · when and where
2026-03-02T02:14:07Z fw-edge pf: ALLOW src=10.20.0.30 dst=91.204.17.5:443 bytes=412880311 flag=ANOMALY
An unlisted upload leaves the relay at 02:14:07, which falls in the swing shift. Only staff on duty that shift stay in play (after shift swaps by mail).
Clue B · auth.log on bkp-relay · who got in, two minutes earlier
2026-03-02T02:12:07Z bkp-relay sshd[4411]: Accepted token for svc-sync (tk_9f3a1c) from 10.20.9.1 mac=3C:52:82:11:9A:xx
The switch masks the last MAC octet, but the first five still match only one hardware batch, and so only some laptops.
Clue C · decrypted token registry on auth-db · who may use that token
tk_9f3a1c svc-sync scope=Engineering,Security issued=2026-05-30Finance and Sales cannot use this token. The archive passphrase is hiding in an IT-Ops mail.
| Suspect | A: on duty | C: token scope | B: MAC batch |
|---|---|---|---|
| Marta Novak | yes | yes | yes |
| Jonas Haas | yes | yes | no |
| Priya Okafor | yes | no | yes |
| Dmitri Brandt | no | yes | yes |
| Elena Moreau | no | no | no |