Please, do not write just a link to original writeup here.

Original writeup (https://gospelofmark.ch/sha2017-junior-ctf-deleted-file-forensics.html).