– Hey, Mabel! Help me
– What`s up, Gruncle?
– I`ve cleaned up the store recently and now some stuff is missing. I think It must be somewhere here
We were given a zipped file with a “something” directory containing a Chrome app data directory.
One of the things to do, is to load directly the profile into Chrome (why using carving, or forensics tools?).
C:\Program Files (x86)\Google\Chrome\Application>chrome.exe --user-data-dir="D:\CTF\JuniorCTF\something\Google\Chrome\User Data"
You don’t know where to start after?
We have the answer! 😀
After looking into the history, we looked into the cache:
Searching “flag” we found:
There’s only one video available:
Flag was “Well_done_You_are_find_me.”…well in fact not at all.
What a troll! 🙁
Flag was A_little_bit_of_magic