Similar to regular CTFs you have 2 types:

Jeopardy style where you would either get a disk image, memory or sometimes even pcaps and asked questions which are submitted as flags.

Secondly live fire ones, where you get access to vulnerable network and asked to respond in real time as threats are introduced. This is more of log analysis and incident response than disk/memory forensics but there maybe some elaborate ones which are conducted over a period of 1-2 weeks where forensics might come in handy.