**Official Writeup**

**tl;dr**

* Extract User ID and Workspace ID of the Slack workspace participating.
* Extract the first & last 3 characters of text from the Anydesk Remote connected PC’s thumbnail wallpaper.
* Extract the type of filesystem of the USBs connected to the system.
* Extracting active duration of Voice Modulator application used by parsing Windows Activity timeline.

Link to the writeup: [https://blog.bi0s.in/2021/08/16/Forensics/Heist-Continues-InCTF-Internationals-2021/](https://blog.bi0s.in/2021/08/16/Forensics/Heist-Continues-InCTF-Internationals-2021/)

Author: [g4rud4](https://twitter.com/_Nihith)

Original writeup (https://blog.bi0s.in/2021/08/16/Forensics/Heist-Continues-InCTF-Internationals-2021/).