See the link.

Original writeup (https://rawsec.ml/en/HackDatKiwi-2017-write-ups/#100-eluware-1-forensics).