Back to Forensics Challenges

Problem

description

We were given an image file for this challenge. I decided to open it in FTK Imager, which prompted for a password which we did not have. So I decided to look at the description which just says investigate the clues. Looking at the title it looked creative saying Do[ro x2] which I thought could mean Do and then ro two times leading to Dororo. I thought that might be the password and sure enough it was.

The flag itself wasn’t hard to find since there was only one file in the image which contained the flag

BattleCTF{You_d0_1t_like_4_pro_forensicator6578888}