You are a Junior Technical Officer at the Tamil Nadu Cyber Crime Coordination Centre in Chennai. Your Inspector calls you into the Forensics Lab at Ramanathapuram campus early morning. A rack-mounted server sits on the evidence table. Case file reads: FIR No. 47/2024, PS Thousand Lights, Section 66C IT Act.
The CI explains the situation. A gang in Tiruppur ran an online fraud network targeting silk merchants. When the District Cyber Cell raided their office, the suspects wiped everything. Laptops formatted. Phones factory reset. But they missed one server hidden behind the false wall. The server has no keyboard, no monitor connection. Just power and ethernet. When your team powered it on, it started listening on TCP ports automatically.
The Tiruppur SP wants answers before the next hearing at Coimbatore Sessions Court. The suspects claim the server is empty. Your Inspector thinks otherwise. Someone built this machine to hide evidence inside its network responses. The data is there, but only people who understand binary protocols can extract it.
You connect your forensic workstation to the server. Two TCP ports are active. Each one responds differently when you send data. The responses look strange. Sometimes shorter than expected. Sometimes they contain bytes you never sent. This is not random. This is deliberate.
Your task is clear: analyze these TCP services, understand how they process data, and extract the hidden evidence. The Tiruppur gang thinks they are clever. Show them that Tamil Nadu Cyber Crime is cleverer.