RingZeroCTF - Forensics - I made a dd of Agent Smith usb key Objective Get Flag Solution: I loaded the DD file up in autopsy to look at deleted files Started a generic case added the DD I chose analyze to let autopsy do the dirty work now I checked the deleted files found the flag in the first orphaned file
@circusmonkey404 on the twitters; DM for contact