Your CTF Has an Expected Answer. Your Investigation Doesn’t.
Brief
Capture the Flag (CTF) exercises are one of the ways to learn digital forensics because they make you do the work. You have to find the artifact, understand what it means, sometimes validate it manually, and usually figure out at least one thing you did not know before you started.
A good CTF can force you into unfamiliar file systems, mobile applications, logs, databases, memory, network data, or tools you would not otherwise touch. That is useful training. It builds technical skill, persistence, and confidence.
The other benefit and perhaps the most important is self-induced stress. The pressure of not knowing if you can solve it, or trying to beat the clock against competitors, creates a noticeable feeling of pressure but without the stakes of a real case.
But every CTF contains an assumption that does not exist in a real investigation. In a CTF, there is an expected answer.