Forensics 100

[Question]

Find the key

[Files]

Local Mirror: f100_6db079ca91c4860f.bin

[Summary]

flag was found by noticing the file named key marked for deletion had clever text stating it was otherwise

[Answer]

notdeleted,neverexisted

Walkthrough

// Using Windows Environment
0. Copied bin into temp directory and opened cmd shell in same directory.
1. Determined the file type: type f100_6db079ca91c4860f.bin | more
2. ... didn't pan out and returned blank result.

3. Opened bin with UltraEdit and scrolled down looking for familiar identifiers
4. Found string NTFS and determined it is some sort of Windows image, renamed bin to img.

5. Loaded up WinHex and file system is apparent. (looking good)
6. Looking for interesting files - notice one called key and appears to be deleted (flagged)
7. I click on it and see english wording "n.o.t.d.e.l.e.t.e.d.,.n.e.v.e.r.existed" (periods represent white space)

8. I copied this into the answer box and got Wrong! ... played longer then moved onto another challenge.
9. Fast forward 12 hours later; still can't find anything that makes sense throughout the file system.
10. Kept staring at this string and removed whitespace entirely "notdeleted,neverexisted".
11. Pasted this into the answer box and got Correct! /facepalm

Write-up: Squidz-R-Us