C:\CTF\GASLIGHT\BLACKOUT.EXE _□X

BLACKOUT

forensics 158 solves by riyc

Challenge

i was doing my work, then my power went off! my computer spat this out afterwards, can you recover the flag?

File given: recovered_file, no extension.

Approach

The file has no extension, so the first step is just figuring out what it actually is. Running it through file gives the answer immediately:

$ file recovered_file
recovered_file: PDF document, version 1.4, 8 page(s)

So it's a PDF. When you open it's blacked out, but you can literally just copy and paste blacked-out PDFs. It's just a black highlighter the majority of the time. The key is just sitting right there.