Operation False Flag

TRACE · LINUX · difficulty 5 · ~45 min · 19 steps

Tor is not broken and you are not going to break it. Follow what the operator broke instead.

Briefing

Forty gigabytes left the customer database over eleven nights. The egress is Tor, every session, and the network path stops at an exit relay run by a volunteer in another country who has done nothing wrong. That is not a failure of your investigation. It is Tor working exactly as designed, and no amount of packet analysis will change it. Accept the wall early, because the time you do not spend hitting it is the time you have for the part that actually works: an operator is a person running software under pressure for eleven nights, and people leave traces. You have the Zeek logs, an evidence share, a Tor client on this workstation, and no authority to touch anything that belongs to anyone else. Where this ends is a referral package. It does not end with a name.

Objectives

• Establish where the network evidence genuinely stops, and stop there
• Find the session that did not go through Tor
• Follow the operator's own mistakes across the channels they chose
• Link two personas by something neither of them can retract
• Preserve it, package it, and hand it to people with subpoenas

Return to the range lobby