Exif Metadata

Category: FORENSICS · Difficulty: Basic · Points: 100 · Challenge: 479

Background

A physical flash memory drive recovered from an unauthorized drone flight near a maritime container terminal contains surveillance photography. Threat actors failed to purge hardware markers and geodetic tags before abandoning the unit. Audit the internal file descriptors. FORMAT: FLAG{ }

Analysis

The evidence file is 216 bytes and carries a generator marker followed by a single configuration line. Reading printable runs across the file recovers the value directly:

$ strings -n 8 evidence-037.jpg
[FORENSIC_TRIAGE_TARGET_037]
CONFIDENTIAL_FLAG=FLAG{cwa2026_663a39d7595df83f}

The file holds no filesystem image, no archive structure and no encoded payload beyond the plaintext line above, so the EXIF parsing work described in the brief was not required.

Result

FLAG{cwa2026_663a39d7595df83f}