DATACENTERGHOST
--:--:-- UTC
Active incident Forensics · SQL · Log correlation Difficulty: Hard

CipherTech Global · Case #CHIMERA-99

Somebody walked 2.5 GB of Project Chimera out of the building.

On 14 November 2023 the IDS flagged a sustained upload leaving CipherTech HQ. The data was the mask set for a prototype quantum processor. The logs point at a trusted researcher, but the logs don't tell the whole story. You get the full evidence database, a floor plan and a SQL console. Nothing else.

Read the briefing → Open evidence console
2023-11-14 15:13:52Z [HIGH] LOCAL Sustained large upload to egress proxy (>2 GB in 10 min) 2023-11-14 15:16:02Z [PAGE] INC-7731 acknowledged by IT Operations 2023-11-15 09:00:00Z [CASE] Forensic snapshot sealed · ciphertech.db · 19 tables
19evidence tables
6answers in the flag
34suspects on payroll
0servers needed

How to play

01

Briefing

The incident, the six questions you must answer and the flag format.

open → 02

Facility blueprint

Floor plans with every badge reader. You'll need them to follow people through the building.

open → 03

Evidence console

A full SQLite engine running in your browser. Query, join, pivot. Nothing leaves your machine.

open → 04

Submit flag

Check your answer locally. The flag isn't stored anywhere on this site, so there's nothing to scrape.

open →

Prefer your own tools? Download ciphertech.db and open it with sqlite3, DB Browser for SQLite, DuckDB, pandas or anything else you like.