Please, do not write just a link to original writeup here.

Original writeup (https://tw-sas.com/2017/04/27/2017yubitsec-ctf-_forensics_broken/).