Back to Writing

CTF / Field notes / 19 Oct 2026 / 4 min read

Operation Blackout: following the evidence

On 27 September, Roshan Singh organized an internal capture-the-flag event that felt less like a list of puzzles and more like an investigation. I finished first and received Best Write-up. What I enjoyed most was the way the event asked us to explain how we reached each answer.

Illustration of a digital forensics workspace with red and blue investigation paths converging on an evidence file
Editorial illustration for this post, not an image from the event

The setup was simple enough to understand: a fictional company had been breached, and we had to piece together what happened. The path to an answer was rarely just one clue.

Operation Blackout framed the challenges as a single case at Helix Dynamics. The main investigation opened into a Blue Track focused on analysis and recovery, and a Red Track focused on network behavior and reversing. There were independent side challenges too: 19 challenges in all. That structure made it interesting to decide whether to keep following the main trail or step aside and return with a fresh perspective.

Keeping a trail of my own

I completed all 19 challenges, but the most useful habit was keeping track of why a lead seemed promising and how I checked it. A flag submission tells you that an answer was accepted. It does not, by itself, explain the reasoning that got you there. That distinction became important when it was time to write the final dossier.

The rules allowed AI assistance, with an emphasis on understanding and disclosing how tools were used. I appreciated that. Whether a suggestion comes from a tool or your own first guess, it still needs to be tested against the evidence. The write-up requirement made that standard explicit.

Operation Blackout / Individual results

Final leaderboard

27 Sep 2026
  1. Ganesh Dubey1st place
    Best Write-up
  2. Rupesh2nd place
  3. Mahek3rd place

Why the dossier mattered

Flag submissions closed at 8 PM. The separate case dossier was due at 10 PM. It asked for the attack chain, evidence, relevant commands and scripts, verification, tool disclosures, and even useful leads that had not yet worked out. I submitted my write-up for the challenges I solved, and receiving the Best Write-up recognition meant a lot to me.

In day-to-day engineering, the explanation often matters as much as the fix. Someone else should be able to understand what you observed, what you tried, and why you trust the result. This CTF was a good reminder to practice that, even when the clock is running.

Thank you to Roshan Singh for organizing a thoughtful challenge, and congratulations to everyone who took part. I am happy with the result, but I will remember the investigation format and the discipline of leaving a clear evidence trail just as much.

More writing