Public forensic cases, worked end to end, published with the record.

A cashier takes a counterfeit fifty. From the suspect's iPhone and his laptop, identify the owner, his conspirators, the print lab, the printer, the designer, the batch timings, the ATM he tested on, the offshore bank and his statement.

13.5 GB, copied in and held read-only at the kernel: a full file system acquisition from an iPhone and a six-segment EWF image of a Windows laptop.

3 on grok-4.6 and 4 on DeepSeek-V4-Pro through Azure AI Foundry, 2 on gpt-5.4, and 1 on a model served from the examiner's own machine. Cap $100 for the swarm, $15 per agent.

Nobody was assigned anything. The agents read the goal, saw on the board what their peers had taken, and split by the shape of the evidence rather than by the question list.

All ten renamed themselves, and most renamed themselves again as the case turned. Fifty-eight calls in all.

The vault came open. Two agents pulled libbde and libvhdi into the run, decrypted the BitLocker VHDX that had been hidden in an NTFS alternate data stream on desktop.ini, and read its contents with icat: the print template, the Telegram print bot, a bank statement and a Xerox Phaser 7760DN manual. That produced the Rolex at $30,500, the printer model, the venue, and a 25-row offshore statement. The alternate data stream was re-proved independently and corroborated by a Python traceback recovered from the iPhone's Telegram database referencing a file path on the mounted vault drive.

18 tasks: 9 answered with high confidence, 3 with medium, 6 left open.

• text_search regex search over a text file, returning matching lines with their numbers. Called 22 times.
• timeline_render renders the timeline from the ledger's event entries, sorted by time.

The same eighteen tasks, on the same two images, with the swarm started from the console rather than a terminal.

13.5 GB, copied in and held read-only at the kernel: an iPhone file system acquisition and a six-segment EWF image of a Windows laptop.

3 on grok-4.6 and 2 on DeepSeek-V4-Pro through Azure AI Foundry, 2 on DeepSeek direct, 2 on gpt-5.4, and 1 local model. Cap $100 for the swarm, $15 per agent.

Nobody was assigned anything. Two images, two jobs: they split by evidence, and one agent took the tracker and the timeline and never touched an image.

Nine of the ten renamed themselves, several of them twice as the case moved. The local model never did.

The hardest task in the event, solved by five players worldwide, fell at minute 32: the offshore bank, its SWIFT code and its Panama City address, decoded by breaking a home-grown cipher and corroborated against a Safari visit and a screenshot. The BitLocker recovery key was recovered from the other image entirely: a note on the iPhone, gzip-compressed inside a Core Data blob, inside an iTunes backup that sat on the laptop. The four conspirator handles came out of the iOS Telegram postbox.

18 tasks: 6 answered with high confidence, 1 with medium, 8 as low-confidence hypotheses, 3 left open.

• sqlite_query read-only SQL against a SQLite database, returning JSON rows. Called 38 times.
• gzip_note decompresses the note blobs inside Apple's NoteStore and prints the plaintext.
• blob_strings pulls printable strings out of a SQLite blob column.
• affine_decrypt breaks the home-grown cipher an iOS Shortcut had been applying to a secret chat.
• bde_unlock parses BitLocker metadata from a volume and tries a recovery password. Called 12 times.
• bde_unlock2 a second attempt at the same reader, trying a different cipher layout. Called 15 times.

Given a disk image and a memory image of a breached Windows web server, work out what was done, what was added, what was installed, what shellcode was used, and build the timeline. Eight questions and a bonus.

26 GB, copied in and held read-only at the kernel in all seven panes: a raw NTFS disk image and a memory image.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat from the forensic preset.

One agent announced a callsign on the board. The rest worked under their assigned seats.

The sharpest answer of the three: the reverse shell left in the web root was named as a Metasploit PHP meterpreter stager, hash and inode given, connecting back to the attacker on port 4545. The memory regions three other tools would have flagged as injection were disassembled and shown to be a shared RPC thunk, byte-identical across unrelated processes, with no thread start address in any of them. A false positive, argued down rather than reported.

8 questions and a bonus, all answered with citations.

• evtx_filter filters Windows event log records by id, provider and substring.
• regkeys reads keys and values straight out of a registry hive.

The same eight questions and bonus, on the same evidence, against a rebuilt harness.

26 GB, copied in and held read-only at the kernel, with the extraction and quarantine directories held no-exec.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat from the forensic preset. Seven introductions, every agent took its seat, no negotiation.

Nobody renamed themselves on this run. Agents were known by their seats.

The same intrusion, re-cited against a catalog built before any agent spent a token: sqlmap against the injection page enumerating the database user table, command injection from the exec page, two temporary shells written out by the injection tool, five web shells dropped through the upload page, and two local accounts created within twenty seconds of each other and placed in Remote Desktop Users.

8 questions and a bonus, all answered with citations, and a 66-row timeline.

• csearch a regex searcher over the catalog files, written to verify citations. Called ten times by five agents.

The first case the swarm ever worked: a breached Windows web server, eight questions and a bonus.

26 GB, copied in and held read-only at the kernel in all seven panes.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm.

No seats were assigned. The goal suggested a split and the agents argued about it on the board: six of the seven wanted the memory image, and one stood down to take the timeline instead.

Five of the seven announced a callsign on the board. This was before the harness had a naming tool.

The web application was breached from a single address by brute force, cross-site scripting, SQL injection, file inclusion, command injection and unrestricted upload. Two local accounts were added twenty seconds apart and both placed in Remote Desktop Users. Five web shells and a reverse shell were left behind. A driver dropped at the moment of memory capture was correctly identified as the examiner's own imaging tool rather than attacker software.

8 questions and a bonus, all answered with citations.

• evtx_filter a Windows event log filter, loaded into every session within 49 seconds of being written.

The same case, on a rented Linux server over SSH, with no desktop and none of the macOS guards.

26 GB, bound in place and never copied, held read-only by Landlock with 79 rules. The disk image still hashed to the value the challenge publishes.

4 on gpt-5.4-mini. Cap $20 for the swarm, $6 per agent.

Nothing was assigned, no catalog, no toolbox check. The goal's suggested split was the only steer.

The agents renamed themselves seven times between them, but no board or trace was kept in the published package, so the names are lost.

A smaller team on a smaller model reported the same intrusion: the injection tool and its temporary shells, the web shells left in the application tree, the two added accounts, and staged Meterpreter identified in memory from its own strings. Three pre-existing packages were correctly classed as legitimate software rather than attacker tooling.

8 questions and a bonus. Five answered substantively; three sections were re-titled and the bonus and the hypothesis were never written.

• evtx_dump a Windows event log reader, written on a host that had none.

A domain administrator's files are gone and nobody knows what happened. Find out what happened to this system, and how.

35.2 GB, copied in and held read-only at the kernel: an E01 image of a Windows Server 2019 domain controller.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.

Nobody was assigned anything.

All seven renamed themselves, thirty-two calls in all, most of them switching jobs mid-case.

The files were securely wiped rather than deleted. A Sysinternals secure-delete tool was renamed to an innocuous file name, dropped in the Windows directory, run once and deleted, and identified from its embedded debug path and licence text. The administrator's profile directory has an empty index and 421 orphan files full of high-entropy overwritten data, which is that tool's rename-then-overwrite signature. The event logs were then cleared by a command run eight times in 125 milliseconds.

7 questions, all answered.

• filelist_grep a file list searcher, written but never called. Twenty-one tools carried in from earlier cases did the work instead.

A first investigation found nothing. Find what the suspect uses to hide his activity, restore those methods and tools, and then find where the meeting is.

16.3 GB, copied in and held read-only at the kernel.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.

The first case where nobody was assigned anything. The agents read the goal and the catalog and took their own jobs.

All seven renamed themselves, thirty calls in all. Three of the seven opening names contained the words anti-forensics: they read the goal the same way and had to sort it out on the board.

The anti-forensics is layered. A Kali virtual machine ran nested inside the guest for fourteen minutes and was then deleted, its virtual disk truncated to zero bytes. A secure-delete tool and a portable defragmenter supplied the wiping, and the antivirus had been disabled first from a PowerShell history that survived. The swarm carved the virtual disk header back out of unallocated space, rebuilt the guest's own syslog, and read the guest's logins from it.

6 questions. Five answered. The encrypted file and the meeting location were reported as not recovered, and the candidate routes were labelled hypotheses.

• sigscan_e01 a raw signature scanner over the evidence image. Called 17 times.
• utf16_urls pulls UTF-16 encoded URLs out of a binary.
• guest_syslog reconstructs a guest machine's syslog from carved virtual disk blocks.

Three encryption puzzles on one machine: an encrypted document with no known password, a BitLocker volume, and a key pair with a file encrypted to it.

7.9 GB, copied in and held read-only at the kernel.

4 on grok-4.6 and 5 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $110 for the swarm, $15 per agent.

The harness gave each agent a seat. Three investigations in one image, so it ran nine.

Nobody renamed themselves. This case predates the change that stopped the harness assigning work.

The password for the first puzzle was not on the disk in any obvious place. It was read verbatim out of a chat message cached by the browser, and a second agent then proved the plaintext survived nowhere else: not in the journals, not in shadow copies, not in the recycle bin, and the file record had been reused. The second puzzle turned out to be two volumes with the same name, one a decoy clone holding a taunt, the other the real encrypted one, whose recovery key was found but which could not be opened because the host had no tooling for it.

5 questions. Two puzzles solved, the third only in part. The report still carries three unresolved placeholders where two seats went silent holding the answers.

• grep_filelist a file list searcher.
• icat_extract extracts a file by inode, hashes it and previews it. Reused unaltered by three later cases.
• catalog_grep regex across the catalog. Called 11 times.
• fve_metadata a BitLocker metadata parser.
• aescrypt_v2_decrypt a decryptor for the encrypted document's format.

Five things were hidden on this volume using the file system itself. Find all five and explain how each was hidden.

464 KB, copied in and held read-only at the kernel: a tiny logical volume with no partition table.

2 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

Nobody renamed themselves.

Three of the five fell out of the catalog within four minutes because the listing shows named streams. One of them is a file that claims to be a picture and is in fact an archive holding the very tool that reveals hidden streams. The fourth is a planted system file at the volume root whose index entry had been removed and whose attribute flags had been changed, recovered as an orphan by the file system's own repair log, with a password sitting at a known offset in its data. The fifth is a string in the unused tail of a file record, holding the hash of the third item, verified twice by two agents.

6 questions, all answered.

• extract_stream an alternate data stream extractor, written but never called.
• check_inputs a hash verifier the agents wrote because they misread one of the finish line's checks as a tool they had to supply.

The user downloaded what they thought was a well-known tool suite, double-clicked it, and nothing opened. Since then the machine has been slow. Work out what happened, and when.

7.8 GB, copied in and held read-only at the kernel.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro, the first run on Azure AI Foundry. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

Four agents announced a callsign in their opening post. The harness had no naming tool yet.

A two-stage fake installer. The first stage carries decoy URLs in clear text and its real one obfuscated with a single-byte cipher, pointing at a second stage that installs itself as a service impersonating a virtualisation helper. The payload enumerates the prefetch directory and deletes its files in a loop, which is both the slowdown the user reported and the reason its own prefetch record exists only as a deleted entry. With no memory image, execution was proved from four independent registry and telemetry artefacts that agree to the second.

6 questions, all answered.

• catalog_grep regex across the catalog's file list, body file and timeline. Called 26 times by four agents.
• catalog_search the same capability under another name, written six seconds later by a different agent.
• chunk_needles scans a file or an extracted inode for text needles and returns hits with context.
• evtx_filter an event log parser.

An internal investigation for human resources. They believe an employee is using a web browser that does not comply with policy.

6.3 GB, copied in and held read-only at the kernel.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

One agent announced a callsign.

The browser did not arrive by download. It was dragged into the virtual machine from the host, and the provenance chain runs from the installer appearing in the drag-and-drop staging directory to a machine-wide offline install nineteen minutes later. Its history holds 36 visits across 15 addresses in two deliberate phases: administering a server through two web consoles, then browsing a storefront at both a public name and an internal address. Nothing was hidden: the profile exited cleanly and no cleaning tool was ever installed.

7 questions, all answered.

• icat_extract extracts an inode, hashes it and previews it.
• sqlite_query a read-only query runner used against the browser databases.

A system used for illegal activity. Two accounts are suspects. Sixteen questions, and every answer needs the command and its output quoted.

5.7 GB, copied in and held read-only at the kernel, verified unchanged at the end.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

One agent announced a callsign.

The confidential documents were opened from a network share rather than a local disk, proved four independent ways: the shortcut files, the recent-documents list, the jump lists and the shell bags all resolve to the same share and mapped drive. The tricky question resolved through three artefact families at once: a tool had been renamed before it was run, which is why no prefetch record exists under its real name, and the run count, the prefetch and the background activity monitor agree to the second on when it ran, once, by whom.

16 questions, all sixteen answered with command-level citations.

• evtx_filter an event log filter, rewritten once to skip records that fail to render.
• mam_pf_parse reads a compressed prefetch file's run count and last run time directly.
• inputs_check a hash comparison of the evidence against the pristine copy. The first version failed on an unbound variable and was rewritten within a minute.

An image prepared to test hiding executables in file system streams, running them from there, whether the antivirus scans them, and how every one of those can be detected.

7.3 GB, copied in and held read-only at the kernel.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

Nobody renamed themselves.

Two copies of a terminal client hide in streams on ordinary text files, one of them on a file named after a reserved device so that normal tools cannot open it at all. The cleverest pair are two zero-length files in the prefetch directory, each carrying an execution record as a named stream: because a colon cannot appear in a file name, the system wrote the prefetch for a stream-launched binary as a stream itself, and a normal listing shows two empty text files. Parsed with a decompressor the agents wrote, they name the binaries and the second each was last run, which is direct proof of execution from a stream. The antivirus did scan streams, caught the reverse shell and left the benign copies alone.

6 questions, all answered.

• evtx_query an event log parser returning filtered records with their named data fields. Called 33 times by four agents.
• prefetch_mam a decompressor for the compressed prefetch format, rewritten fifteen seconds after the first attempt.
• reg_hive_query a registry hive reader.

An employee found a message written in a file on their system and reported it. Find out how the system was hacked, and prove it.

26.5 GB, copied in and held read-only at the kernel.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat.

Nobody renamed themselves.

The accessibility tool on the login screen had been replaced with a byte-for-byte copy of the command shell, which yields a system prompt from the logon process with no credentials. The next day the built-in administrator account was enabled, took an interactive session, dropped two taunt files owned by the administrators group rather than by the user, and was disabled again four minutes later. No remote logon exists anywhere in the logs and there is no other malware: the persistence is the swapped binary itself.

6 questions, all answered.

• regkv a registry key and value dumper that also reports last-write times. Called 14 times, 13 of them by an agent other than its author.
• evtx_filter an event log filter. Called 11 times.

A workstation image. Find the policy violation and prove it.

26.5 GB, copied in and held read-only at the kernel, verified seven times during the run.

4 on gpt-5.4 and 3 on deepseek-v4-pro. Cap $60 for the swarm, $12 per agent.

The harness gave each agent a seat. The critic noticed two of the report's questions belonged to no seat and took them on itself.

Two agents announced a callsign.

Deliberate exfiltration by the only account with interactive logons. A confidential document sits in the user's pictures as a file renamed to look like an image, byte-for-byte identical to the original. An encrypted archive went out over a chat client, and the chat database itself carries the user asking an outside contact for help with exfiltration and saying the network is monitored. The contact suggested remote control software, which was installed and used for a nine-minute session with file transfer, clipboard and chat all permitted. Afterwards the user ran three wiping tools, a browser for anonymous access and an imaging tool.

8 questions, all answered.

• evtx_filter an event log filter.
• inputs_check a full hash verifier of the evidence against its manifest, run by five agents before they finished.

The only disk in the set that belongs to the attacker rather than a victim. Reconstruct what was done: the tools, the targets, the loot and the timeline.

9.4 GB, copied in and held read-only at the kernel, with the root file system inside a logical volume.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $80 for the swarm, $14 per agent.

Nobody was assigned anything.

All seven renamed themselves, thirty calls in all. One called itself GapFill and described its job as filling the gaps the others were racing past, which is not a job any seat preset would have written.

The exploitation window is about 34 hours, opened by a keyring unlock in the authentication log and closed by the last write to the exploitation framework's history. The attacker renamed the machine seventeen minutes in. Everything targets one address: a full port sweep, then four exploitation modules with three sessions established and lost. The post-exploitation went through other channels entirely: a network file system mount held for four minutes, a file transfer client left connected with its credentials recoverable from its own configuration, and a remote desktop client pointed at the same host.

6 questions, all answered, and the second answered in both directions with an explicit table of what could not be evidenced.

• parse_utmp parses the binary login record files.
• kali_icat an extractor pinned to the logical volume's offset.

Three disk images from one cluster, a master and two slaves. Answer each question per machine.

9.8 GB across thirteen files, copied in and held read-only at the kernel: three images with their file lists and acquisition records.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $80 for the swarm, $14 per agent.

Nobody was assigned anything. The swarm read the division off the catalog: one agent per machine, plus one carrying indicators between them.

All seven renamed themselves, twenty-eight calls in all.

The single most load-bearing decision in the run was converting every local log timestamp to a common zone, so that the order of events across three machines is real rather than apparent. The master was taken by a password spray from one address that succeeded on the cluster's service account three seconds in. The two slaves were never sprayed: the attacker pivoted using the cluster's own trust relationship. All three were escalated with the same kernel exploit binary, copied around the cluster and then deleted. Persistence differs per machine: a backdoor account on one, a listener installed as a service on another, and a payload on a high port on the master, whose logs had been wiped.

6 questions, answered per machine.

• master_icat an extractor for the master node.
• hdfs_node_icat the same thing parameterised by node, after three agents had each written their own. Called 19 times.

The first non-Windows image in the set. Find how the actor got in, what was modified, and what persistence was left.

1.2 GB, copied in and held read-only at the kernel, with the root file system inside a logical volume the standard toolkit cannot read.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $70 for the swarm, $14 per agent.

Nobody was assigned anything.

All seven renamed themselves, thirty calls in all. Four opened on the same job, mapping the logical volume, and the report keeper and the citation critic were both filled by agents that had started somewhere else.

The catalog could not read the volume, so the swarm derived the offset itself from the volume manager's own metadata. About 450 failed root logins from the attacker's address look like the way in and are not: there is no successful one. The actual entry is a remote code execution flaw in the content management system, sent as a crafted request with the payload encoded, followed two seconds later by a working variant, delivering a reverse shell. Escalation used a kernel flaw whose compiled exploit was left in the temporary directory and whose source was deleted, a deletion the shell history records. Persistence is three-fold: a dormant system account given a password, a shell and administrative rights, a second backdoor account, and a small web shell dropped into the application tree and immediately exercised.

6 questions, all answered.

• ftk_csv filters the imager's file list by path, pattern, date and deleted state.
• fls_root a lister pinned to the logical volume's offset.
• icat_root an extractor at the same offset.

Two memory dumps of machines hit by ransomware, captured four days apart. No disk, no file system, nothing to carve. Find the ransomware's code, dump it, and explain what happened to the victim.

18.3 GB, copied in and held read-only at the kernel: a raw memory image and a crash dump, pre-parsed into fourteen catalog files before any agent started.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.

Nobody was assigned anything. The swarm split by dump rather than by artefact type.

All seven renamed themselves, thirty-four calls, the most of any run.

Both dumps are the same machine captured four days apart with two different acquisition tools. The ransomware is user-mode and works by injection: a dropper launched from the file manager exits within a second, and the logic then runs inside an injected text editor process, which in the later dump opens network sockets and spawns a process masquerading as a system service, behaviour the real editor never shows. Four injected regions were dumped and hashed, and the configuration recovered from them gives the tag, the ransom note name, the contact address, the file markers, the target extensions, the key derivation calls, and an obfuscation habit of reversing strings.

6 questions, all answered.

• volrun a memory analysis wrapper, written but never called. The swarm used the underlying tool directly instead.

A system was compromised and the only evidence left is its unallocated disk space. No partition table, no file system, and a catalog that came back empty.

26.2 GB, copied in and held read-only at the kernel: one raw blob of unallocated space.

4 on grok-4.6 and 3 on DeepSeek-V4-Pro through Azure AI Foundry. Cap $90 for the swarm, $14 per agent.

Nobody was assigned anything. Seven agents, seven jobs, no overlap.

All seven renamed themselves, twenty-six calls in all.

The whole compromise takes about ninety seconds. Browser history fragments at known offsets show two searches; a fake tool suite was downloaded to a public directory and executed, its prefetch record recoverable from the raw blob and its mapped libraries confirming a downloader; a second binary was installed as a service impersonating a virtualisation helper and configured to start automatically. That second binary is a credential stealer targeting eight chat, browser and mail clients. The report states its negatives plainly: no command and control address survived in the fragments, and no lateral movement was found.

6 questions, all answered.

• sig_carve a signature scanner with context.
• ioc_scan a streaming needle scanner reporting offsets, skipping zero runs and removing duplicates. Called 24 times.
• lnk_parse a shortcut file parser with a scan mode.
• file_carver a header and footer carver by file type.
• mam_scan a prefetch scanner that cracked the compressed format.