Original writeup (http://shankaraman.wordpress.com/2013/10/03/su-ctf-forensics-100-examtheft-writeup/).