Official Writeup

tl;dr

• Finding Chat application
• Extract unread message count from NTUSER.dat.
• Extract the last executed timestamp of the chat application.
• Extract the Version of the chat application.

Link to the writeup: https://blog.bi0s.in/2021/08/16/Forensics/Ermittlung-InCTF-Internationals-2021/

Author: g4rud4

Original writeup (https://blog.bi0s.in/2021/08/16/Forensics/Ermittlung-InCTF-Internationals-2021/).