What happened?
A company’s incident portal was abandoned mid-investigation. The remaining network traces are incomplete, the logs are out of order, and a final evidence record is missing.
CASE FILE 0417FORENSICS / WEB
The Forgotten
Incident
An abandoned response portal still has a story to tell. Reconstruct the breach, follow the evidence, and recover what was buried.
NXCTFHARDONE CASE · NO HINTS
Your assignment
Work as the investigator. Use the supplied artifacts, identify the server history, navigate the isolated archive, and correlate the surviving evidence.
What you need
Curiosity, a packet viewer, a text editor, and patience. Everything else is in the case file. The environment is synthetic and safe.
THE CASE FILE
Evidence locker
ISOLATED SERVICE
Archive export portal
The evidence portal is part of the case. It exposes only synthetic files and cannot reach this machine’s filesystem.
CLOSE THE CASE
Submit your
finding.
When the evidence points to the final record, submit the flag below. Take your time—the case only closes once.