Forensics 200

[Question]

Find the key

[Files]

Local Mirror: f200_02b7b50f575759cff7.tar.lzma

[Summary]

identified the transparent images as layers and just stacked them to get solution

[Answer]

http://is.gd/ced7F

Walkthrough

// Using Windows Environment
0. Copied bin into temp directory and opened cmd shell in same directory.
1. Determined the file type: type f200_02b7b50f575759cff7.tar.lzma | more
2. ... returned beeps and garbage. (let's try 7zip)

3. Right clicked and used 7zip to extract to directory as tar
4. Right clicked and used 7zip to extract to directory again (dumped 1,121 png files)
5. Opened first png with Windows Picture and Fax Viewer (saw a bunch of pseudo-random dots)

6. Looked at a few more and had what looked like more but different (figured it was a layered message)
7. Opened the directory on my Mac for some command line fu and wrote the following script to merge all the images into one image
8. echo -n "convert " > itcombino.sh; printf "IMG_%00004u.png " {1..1121} >> itcombino.sh; echo -n "-layers merge _final.png" >> itcombino.sh; chmod +x itcombino.sh && ./itcombino.sh

9. I opened the merged file _final.png with preview and noticed that it was the same url repeating http://is.gd/ced7F

10. Earlier on another team member posted it as http://is.gd/ced7f (lower case f) and that took hours of going through Sanjay's page
11. http://is.gd/ced7F on the other hand takes us the famous "Super Sexy CPR" video that's been on social networks the past week.
12. After reading the comments and viewing the source I pasted in the displayed URL http://is.gd/ced7F and got Correct!

Write-up: Squidz-R-Us