diff --git a/tests/test_forensics.py b/tests/test_forensics.py
index 805f022..17ccf4d 100644
--- a/tests/test_forensics.py
+++ b/tests/test_forensics.py
@@ -5,7 +5,8 @@ import stat
 import sys
 from click.testing import CliRunner
 from ctf.utils import load_config, active_categories
-from ctf.forensics import forensics_group, inspect
+from ctf.forensics import get_metadata, get_flag_strings
+from ctf.cli_forensics import forensics_group, inspect
 
 # Define the persistent test environment path
 TEST_ENV = Path("tests/env")
@@ -88,7 +89,7 @@ def test_inspect_permissions():
     # Set permissions explicitly to 0o755 (rwxr-xr-x)
     test_file.chmod(0o755)
     
-    meta = inspect.callback(str(test_file))
+    meta = get_metadata(test_file)
     
     # Assert correct octal format
     assert meta.permissions_octal == "0o755"
@@ -97,7 +98,7 @@ def test_inspect_permissions():
     
     # Change permissions to 0o644 (rw-r--r--)
     test_file.chmod(0o644)
-    meta_new = inspect.callback(str(test_file))
+    meta_new = get_metadata(test_file)
     assert meta_new.permissions_octal == "0o644"
     assert meta_new.permissions_symbolic == "-rw-r--r--"
 
@@ -112,7 +113,7 @@ def test_inspect_ownership():
         f.write(b"data")
         
     stat_info = test_file.stat()
-    meta = inspect.callback(str(test_file))
+    meta = get_metadata(test_file)
     
     assert meta.owner_uid == stat_info.st_uid
     assert meta.owner_gid == stat_info.st_gid
@@ -142,7 +143,7 @@ def test_inspect_allocation():
         f.write(b"A" * 1234)
         
     stat_info = test_file.stat()
-    meta = inspect.callback(str(test_file))
+    meta = get_metadata(test_file)
     
     assert meta.size == 1234
     
@@ -163,7 +164,7 @@ def test_inspect_hard_links():
     with open(test_file, "wb") as f:
         f.write(b"link")
         
-    meta_single = inspect.callback(str(test_file))
+    meta_single = get_metadata(test_file)
     assert meta_single.hard_links == 1
     
     # Create a hard link
@@ -173,7 +174,7 @@ def test_inspect_hard_links():
         
     try:
         os.link(str(test_file), str(link_file))
-        meta_linked = inspect.callback(str(test_file))
+        meta_linked = get_metadata(test_file)
         assert meta_linked.hard_links == 2
     finally:
         if link_file.exists():
@@ -190,7 +191,7 @@ def test_inspect_inode_device():
         f.write(b"data")
         
     stat_info = test_file.stat()
-    meta = inspect.callback(str(test_file))
+    meta = get_metadata(test_file)
     
     assert meta.inode == stat_info.st_ino
     assert meta.device == stat_info.st_dev
@@ -217,7 +218,7 @@ def test_inspect_extended_attributes():
         except (ImportError, OSError, AttributeError):
             pass
             
-    meta = inspect.callback(str(test_file))
+    meta = get_metadata(test_file)
     
     if has_xattr_support:
         assert "user.ctf_flag" in meta.extended_attributes
@@ -295,3 +296,15 @@ def test_forensics_flag_detect_cli_not_found():
     result = runner.invoke(forensics_group, ["flag-detect", str(test_file)])
     assert result.exit_code == 0
     assert "No flag patterns found" in result.output
+
+def test_get_flag_strings_pure():
+    """
+    Verifies that get_flag_strings extracts expected strings and matching flags directly.
+    """
+    test_file = TEST_ENV / "pure_flag_data.bin"
+    with open(test_file, "wb") as f:
+        f.write(b"pre_flag{hello_world_1337}post_stuff")
+        
+    flags = get_flag_strings(test_file, r"flag\{[a-z_0-9]+\}")
+    assert flags == ["flag{hello_world_1337}"]
+