tl;dr

• Extract keylogger script from the memory dump.
• Extract the master key from the packet capture.
• Reverse the script to get the flag.

tl;dr

• Extract Invalid Login timestamp from the windows registry.
• Extract the timestamp of when a JPEG was opened.
• Extract Google Chrome’s last run time which was pinned to taskbar from windows registry.

tl;dr

• Extract process last run time from the windows registry.
• Extract process run count from the windows registry.

tl;dr

• Digging into windows registry to find process run counts.
• Extracting and parsing AmCache to find the hash of process images

tl;dr

• Memory dump analysis using Volatility.
• Extracting Keepass Master Password from the memory.
• Extracting flag from ZIP archive attached in the Keepass database.

tl;dr

• RAID recovery
• JPEG image extraction from lost disk

tl;dr

• EV3 Robot pklg analysis
• .RSF file recovery

tl;dr

• Chrome history analysis
• File recovery from the memory dump
• Raw analysis of email content
• Environment variables analysis
• RAR password cracking
• Corrupted file analysis

tl;dr

• Master File Table Analysis
• Deleted file data recovery

tl;dr

1. Analysis of memory dump using Volatility framework.
2. Using mac_contacts plugin to get relevant data.
3. Base64 decode to get flag.

Solved by: stuxn3t