http://chrsow.github.io/story/2016/11/21/rc3-ctf-2016-forensics-400.html

Original writeup (http://chrsow.github.io/story/2016/11/21/rc3-ctf-2016-forensics-400.html).