http://notes.avp42.com/ctf/rc3-2016/2016/11/21/rc3-2016-forensics-400.html

Original writeup (http://notes.avp42.com/ctf/rc3-2016/2016/11/21/rc3-2016-forensics-400.html).