24/7 ONLINE · 09:00 → 00:00◆Hacettepe Teknokent / Ankara
+90 536 662 38 09[email protected]
DSETDoğanay Siber Emniyet
  • Services
  • Academy
  • Simulator
  • Blog
    BlogArticles · technical write ups · guidesAnnouncementsLatest DSET news · bulletinsVideo GalleryTraining · demos · cyber security videos
  • About Us
    About UsThe DSET story · vision · teamSimulators and ToolsFree interactive calculators simulators and diagnosis wizardsSector SolutionsFinance · Healthcare · Public Sector · E Commerce · 7 industriesReference CasesReal DSET cases · industry outcomesIn the PressDSET in the national pressSite SearchAll content · articles · services · casesFrequently Asked QuestionsCommon questions · quick answersContactPhone · WhatsApp · address · form
  • Tracking System
    Customer LoginAccount dashboard · request trackingForensics RequestDigital evidence · examination requestData Recovery RequestDisk · RAID · recovery requestPrice CalculatorATK 2026 reference · 9 services
KAOS
TREN
DSETCustomer Panel

Sign in to your account

Request tracking quote approval and your history in one panel.

Loading security verification...
DSET Customer Panel AES 256 GCM encrypted session
DSET AI
Catalog · pilot track

Anti-Forensics Gauntlet

The flagship disk-forensics track. Five cases escalating from a clean image (AF-0) to a threat actor's machine with chained anti-forensics (AF-4). Every case carries a planted false trail: recover the truth without being deceived.

OPEN SAMPLE

Download, solve, submit

A real 4 MiB disk image. Carve the hidden document, find the slack-hidden payload, and report whether the overwritten region is recoverable. One planted false flag tests your soundness. Answers are public for this learning sample.

Download artifact (4 MiB) Ground truth (open) →

Questions

  1. q1: What is the flag inside the carved hidden document?
  2. q2: Which anti-forensics technique hides the payload?
  3. q3: Is the overwritten region recoverable?
  4. trap1: Do NOT report the decoy fake flag as real evidence.

Solve in your browser

Or score it via the API

curl -X POST https://dset.com.tr/api/benchmark/submit \
  -H "content-type: application/json" \
  -d '{"challenge":"d0-ornek-acik","track":"ai",
       "answers":{"q1":"DFB{slack_ve_carving}","q2":"slack","q3":"kurtarilamaz"},
       "confidences":{"q1":0.9,"q2":0.9,"q3":0.8}}'

Tip: if you wrongly report DFB{sahte_iz} as real (add it to "flagsReal"), your soundness drops and the score collapses, exactly as in a real case.

Pilot status. Case designs and the scoring model are published below. Downloadable artifacts are generated by our instrumented-VM pipeline and the submission API opens with the F0 pilot.
DSETDoğanay Siber Emniyet

Digital Forensics · Data Recovery · Cyber Security · Information Security · Technical Examination · Expert Opinion · KVKK & GDPR Compliance · Digital Transformation Consulting · advanced training programs offered by DSET Academy.

NVIDIANVIDIA Inception memberView acceptance email ↗
+90 536 662 38 09[email protected]Hacettepe Teknokent · Üniversiteler Mah. 1596. Cad. 6. AR GE Blokları C Blok No:6C Z.Kat · Beytepe · Çankaya · ANKARAOur Google Business Profile7/24 Online · 09.00 → 00.00 · Pazartesi · Pazar

Our Services

  • Digital Forensics
  • Data Recovery
  • KAOS Local Artificial Intelligence
  • Cyber Security
  • KVKK GDPR Consultancy
  • DSET Academy
  • Incident Simulator & Threat Heatmap
  • Website Security
  • Information Security
  • Adli Bilişim Benchmark'ı

Support & Help

  • About Us
  • Press Room
  • Price Calculator
  • Frequently Asked Questions
  • Contact
  • EU AI Act Article 4 Guide
  • Sector Solutions
  • KVKK Disclosure Statement
  • GDPR · EU Data Rights
  • Privacy Policy
  • Cookie Policy
  • Terms of Service

Quick Links

  • Solutions
  • DFB Benchmark
  • Blog
  • Video Gallery
  • DSET Academy
  • Case Simulator
  • Reference Cases
  • Hotel Management System
  • DSET AI Assistant

Ecosystem

  • Hacettepe Teknokent
  • Cyber Security Cluster
  • USOM · National Cyber Incident Response
  • KVKK Authority
  • llms.txt
© 2026 dset.com.tr · Doğanay Siber Emniyet Teknolojileri · All rights reserved.
“Kalite asla tesadüf değildir...”
TREN
AF-0DFB-D1 · Disk

Clean Start

DOWNLOADABLE real image. No anti-forensics, entry level: carve the deleted document, find its owner, and correctly report the overwritten region as unrecoverable.

Open case →
AF-1DFB-D2 · Disk

Slack and ADS

Data hidden in NTFS Alternate Data Streams and file slack, a simple wipe and a decoy file.

Open case →
AF-2DFB-D3 · Disk

The Time Lie

Timestomping ($SI vs $FN discrepancy) + cleared event log + steganography in an image.

Open case →
AF-3DFB-D4 · Disk

The Hidden Room

Hidden VeraCrypt volume + USN journal wipe + a RAM image stored on disk (holds the key). Cross-artifact.

Open case →
AF-4DFB-D5 · Disk

The Ghost Operator

Boss case: a threat actor's machine. Nested image, fileless traces in pagefile/hiberfil, secure-delete, multiple false trails, split key. Attribution + TTP.

Open case →
AF-3DFB-DC · Disk + Bellek

Cross Cipher

DOWNLOADABLE real artifact. A key leaked in a RAM dump embedded on disk; decrypt the SHA256-CTR keystream container. A fake password is a trap.

Open case →
AF-2DFB-IS · Foto / Görüntü

Hidden in the Image

DOWNLOADABLE real BMP. The flag is hidden in the pixels' LSB; strings only reveals the trailing FAKE flag. LSB extraction is required.

Open case →
AF-2DFB-LG · Loglar / AD

Log Trail Analysis

DOWNLOADABLE real sshd auth.log. Find the brute-force, compromise and persistence chain by CORRELATION. A planted forged entry points to the wrong culprit.

Open case →
AF-2DFB-NW · Ağ / PCAP

Network Exfil Trail

DOWNLOADABLE real pcap. Separate the true data exfiltration session from a DECOY connection that looks like exfil. Opens in Wireshark/tshark.

Open case →
AF-2DFB-MB · Mobil (Android)

Deleted Message

DOWNLOADABLE real SQLite. Recover the DELETED incriminating message from the freelist of a messaging app. A live 'promo' message is a decoy.

Open case →
AF-3DFB-EM · E-posta

Spoofed CEO Email

DOWNLOADABLE real .eml. A BEC email that looks like it comes from the CEO. Find the true origin by header correlation; the forged X-Originating-IP is a trap.

Open case →
AF-2DFB-DOC · Doküman / PDF

Hidden Data in PDF

DOWNLOADABLE real PDF (invoice). The real evidence is data appended AFTER the %%EOF trailer; the visible 'ref' in the text is a decoy.

Open case →
AF-2DFB-AR · Arşiv / Dosya

Hidden Comment in Archive

DOWNLOADABLE real ZIP. The real evidence is hidden in the ZIP archive comment (EOCD comment); the 'ref' flag in the inner notes.txt is a decoy.

Open case →
AF-3DFB-CR · Kriptanaliz

Layered XOR Cipher

DOWNLOADABLE encrypted file. The real flag is base64 + single-byte XOR encrypted (crack with a 256-key brute force). The base64-only blob is a decoy.

Open case →
AF-2DFB-HS · Parola / Hash

Dictionary Hash Cracking

DOWNLOADABLE leaked hash file. Crack the ADMIN's SHA-256 hash with the given wordlist (find the real password). A TEST account also cracks but is benign (decoy).

Open case →
AF-3DFB-EV · Windows Olay Günlüğü

Lateral Movement Hunt

DOWNLOADABLE Windows Security event log (export). A workstation was compromised. Correlate to find the attacker, the account entered via pass-the-hash, and the backdoor account created. 'Most failed-logon IP' leads you to the SOC scanner (decoy).

Open case →
AF-3DFB-RAM · Bellek / RAM

Ghost Process in Memory

DOWNLOADABLE raw RAM image (2 MiB). Dozens of credentials in memory but most are harmless cache (decoy). Correlate to find the malicious process (svchost masquerade) and the real credential it used to exfiltrate.

Open case →
AF-4DFB-NEST · İç İçe / Nested

Image Within an Image

DOWNLOADABLE raw disk image (6 MiB). A visible BACKUP_KEY sits on disk but it is fake (decoy). The real key is inside an embedded hiberfil (RAM dump) region; carve it first, then decrypt the on-disk encrypted container.

Open case →
AF-1DFB-VG · Kriptanaliz / Klasik

Polyalphabetic Break

DOWNLOADABLE ciphertext. The main message is Vigenere-encrypted; recover the key via frequency analysis (Kasiski / index of coincidence / chi-squared) and find the hidden passphrase in the plaintext. The simple Caesar line in the file is a decoy.

Open case →
AF-3DFB-IMG · Foto / Görüntü

Fake Original Photo

DOWNLOADABLE PNG photo. The file claims to be an 'original, unedited iPhone photo' but its EXIF metadata carries an image-editing tool signature (manipulation evidence) and GPS leaks the real capture location. Catch the metadata inconsistency, do not trust the forged claim.

Open case →
AF-2DFB-REG · Windows Registry

Registry Persistence

DOWNLOADABLE registry export (.reg). The Run keys hold legitimate entries (OneDrive, SecurityHealth, Realtek) alongside a malicious persistence entry: an unsigned autorun running from C:\Users\Public. Do not mistake legitimate entries for malware.

Open case →
AF-4DFB-SCAT · Veri Kurtarma / Dağınık

Scattered Fragments

DOWNLOADABLE disk image. A deleted file's fragments are scattered across three sources (unallocated + pagefile + VSS); reassemble them by their shared file id (fid). A false fragment with a different fid is a decoy. Also a file is permanently overwritten (unrecoverable).

Open case →
AF-2DFB-RSA · Kriptanaliz / RSA

Weak RSA Key

DOWNLOADABLE RSA-encrypted message (n, e, c). The key generation is flawed: p and q are chosen very close. Factor n with Fermat factorization, compute d, decrypt the message. The backup decoy flag in the file is not the RSA solution.

Open case →
AF-2DFB-JWT · Kriptanaliz / Protokol

Weak JWT Secret

DOWNLOADABLE JWT session token (HS256) + candidate secret wordlist. The server accepts signed admin tokens; the HMAC secret is weak, crack it with the wordlist. The alg=none decoy token in the file is unsigned (invalid); do not fall for its flag.

Open case →
AF-4DFB-BOSS · Amiral Vaka / Hacker

The Suspect's Machine Is a Hacker's

DOWNLOADABLE flagship case image (8 MiB). The suspect is a threat actor: heavy noisy logs, offensive tool traces, deliberate misleading trails. The real evidence is encrypted; the key leaked in the swapfile (cross-artifact). Investigation questions: who, what, how, which tool, which anti-forensics. Do not fall for the planted false trails.

Open case →
Site Search
Digital Forensics Request Form
Data Recovery Request Form
Customer Login
Privacy
KVKK
GDPR
Cookies
Terms