AN INVESTIGATION IN SIX CHAPTERS

Every backup
has a story.
This one lies.

An employee disappears from the records. A recovery route is quietly changed. Follow Maya’s trail and uncover what happened at Northstar Labs.

Begin investigation Explore the case

THE LAST BACKUP / A STORY-DRIVEN CTF

YOUR ASSIGNMENTFind the genuine route.
06Linked stages
06Security disciplines
1,150Points to uncover

THE INVESTIGATION

Follow the evidence.
One stage at a time.

Each discovery opens the next chapter. Keep the files, question the records, and connect the details.

01100 PTS
OSINT

The missing employee

Find the record that the current directory no longer tells.

02100 PTS
Steganography

More than a photograph

Look beneath the pixels. Maya left something behind.

03200 PTS
Web security

Someone used her name

An accepted approval. But did the account have authority?

04200 PTS
Cryptography

The administrator’s warning

Decipher the message Elias could not leave in plain sight.

05250 PTS
Digital forensics

Seventeen missing minutes

Recover deleted evidence and put the timeline back together.

06300 PTS
Linux security

The wrong recovery route

Follow the preserved evidence. Verify where the backup leads.

BEFORE YOU BEGIN

Trust the evidence.
Not the label.

Maya noticed a change to the company’s recovery route before her account was disabled. Elias preserved a warning. You are the investigator who brings their evidence together.

Open challenges
Make your first discovery

Create an account and start with the missing employee’s archived records.

Submit flags, unlock the next stage

Enter each completion flag in Challenges. Optional hints cost points.

Collect your evidence handovers

Ask the organizer for the forensic image after Stage 4, and Linux access after Stage 5.