In order to see if there is internal metadata which may assist with the attribution of the data, I ran the file through EXIFTool. Further analysis of the file may provide more information on this. Listening to the audio carefully, there is a strange noise around the one minute mark. For example, it starts with “Welcome to Lumon Radio, a tutorial on CSI Linux and OSINT”. Listening to the file, it appears to contain audio content relating to CSI Linux. I therefore considered that the reference to “3 dots” may relate to something else, and could perhaps be an indication that the CSI Linux team were aware that “dots” may be relevant, perhaps hinting at the use of Morse code, for example. I note that to download the file from the player (as it appeared in my browser), there was no “hamburger” option in the player (as seen in the screenshot). This was unfortunately not possible at the time of the investigation. I would typically recommend that the full email and its attachment be preserved in a forensic manner.

As noted in the details of the question, the audio file was received via email. I note that preserving the audio file in this way is not ideal for investigative purposes. I downloaded the audio file, by right clicking on the audio player and selecting “Save Audio As…” as shown in the below screenshot:

The details provided in relation to Question 1 are below: Initial information, as provided at is included below: Section 2 – Audio Analysis (Q1) Q1: The audio file The answers to the specific questions are highlighted in green bold lettering. Copies of all questions are provided within this report. References to these questions may also be abbreviated, for example Q1 for question 1 etc. For ease of reference, these discrete requests will be referred to as questions and will be numbered appropriately in chronological order. Further requests for assistance were made on a continual basis as the investigation progressed, with discrete requests for assistance on specific points. I was initially instructed to investigate and provide details relating to the audio file that was received. The compromise has stopped all production for the CSI Linux team, and they are looking for assistance relating to the compromise so that adequate countermeasures can be put in place. CSI Linux believe that this breach may be related to Command and Control infrastructure running on an Internet of Things device within their office. It appears that a third party has access to (at least) some of their recorded audio content. The CSI Linux team received an audio file indicating that their data has been compromised. I have split the report into a few separate blog articles, as its quite long… this first section goes through the introduction, and the first puzzle, which is around audio analysis.Įnjoy! Section 1 – Introduction Background The report is in a semi-formalised style because I thought that might be fun. You can always come back another time if you get stuck (and I mean REALLY stuck… keep going and keep trying… persistence is another good investigator trait to develop!)Īs the CTF involved writing up a report, I thought that I would share my report here, as it might be of interest or of use to others on casework, testing, or just for the fun. Spoiler alert – I’m about to dive into the solution, so if you want to play with this yourself, don’t read any further. The challenge is still online and you can find it here. If you haven’t already, I would thoroughly recommend having a play with this. These are skills that any investigator, regardless of discipline, should be looking to develop. They need problem solving skills, research skills, as well as the skills and knowledge expected for the specific CTF (be it digital forensic skills, OSINT skills, cyber security skills etc.). I really enjoy CTFs, and think that they are a really good way to keep skills sharp, pick up new tips and tricks, and sometimes to use new software that you may not have had the opportunity to use before. I really liked this approach… though it did mean that I spent probably more time than I should have done writing up a report document over Christmas… and less time that I probably should have spent helping Santa with the wrapping…

Many CTFs are set up so that you gain points for each section that you solve (and sometimes the quicker you solve it, the more points you get). This was the first CTF that I have taken part in where the approach was to solve all the clues, and then provide a report writing up the findings and methodology. By Dr Tristan Jenkinson The CSI Linux CTF – Shake the CobwebsĪs many of you may have seen, I took part in a Capture The Flag competition run by CSI Linux over the Christmas period (titled “Shake the cobwebs”), and was really pleased to finish first!!

Sonic visualiser tutorial