Skip to main content
  1. CTF Writeups/

Forgotten Footprints - UTCTF 2025

·179 words·1 min
UTCTF2025 Forensics Autopsy CyberChef
Miles Handelman
Author
Miles Handelman
I didn't want anyone to find the flag, so I hid it away. Unfortunately, I seem to have misplaced it.

The given file of this challenge is disk.img, of which the scenario claims that the user has misplaced it. Mounting the disk image produces a directory with a bunch of text files containing random data.

I figured it was going to take too long to find the flag by searching the text files for any encoded strings (although looking back on it and seeing the writeups of others makes me realize it would’ve been quicker to search for various encoded variants of the flag format UTCTF{, but I digress). So I put it into Autopsy and began searching through the unallocated space in the disk image because of the hint saying they “misplaced the data.”

After searching through 831 pages of empty Hex content, 832 shows a long sequence of hexadecimal values which could contain the flag.

forgottenflag

Upon entering this massive string of hex values into Cyberchef and decoding from Hex, the flag is produced.

flag

The flag is: utflag{d3l3t3d_bu7_n0t_g0n3_4ever}

Related

Bitlocker-1 - picoCTF 2025
·168 words·1 min
picoCTF2025 Forensics Bitlocker John The Ripper
Event-Viewing - picoCTF 2025
·374 words·2 mins
picoCTF2025 Forensics Event Viewer
Ph4nt0m 1ntrud3r - picoCTF 2025
·232 words·2 mins
picoCTF2025 Forensics Wireshark
RED - picoCTF 2025
·86 words·1 min
picoCTF2025 Forensics Steganography
flags are stepic - picoCTF 2025
·132 words·1 min
picoCTF2025 Forensics Python
Eavesdrop - picoGym
·182 words·1 min
picoGym Forensics Wireshark