New Zealand - Passport (forens)

1MB

CSG_Passport.E01

Open

We first use autopsy to analyse the .E01 file.

Under Select Data Source Type choose "Disk Image or VM File". There is no need to run any ingest modules.

Identify the deleted image file, and export it by right clicking on it then clicking "extract file(s)".

Once the file has been extracted, run exiftool on it to analyse the metadata:

elijah@soyabean:/mnt/c/Users/chiae/Downloads/cyberseagames/F1_CSG_Passport$ exiftool ./CSG_Passport.jpg_original
ExifTool Version Number         : 12.40
File Name                       : CSG_Passport.jpg_original
Directory                       : .
File Size                       : 648 KiB
...
Software                        : DECODE{M3trixM@ster}
...

And we've gotten the flag: CSG_FLAG{M3trixM@ster}