Rating:

# Rewind- Forensics

We are given a zip file which contains two files: rewind-rr-snp and rewind-rr-nodent.log. If we do file command on the first one, we get

> QEMU suspend to disk image

Then first thing I try is to grep for flag

> strings rewind-rr-snp | grep flag{

Then we found the flag{RUN_R3C0RD_ANA1YZ3_R3P3AT} in the result.

Original writeup (https://github.com/liuhack/writeups/blob/master/2018/CSAW/Rewind/README.md).