Rating: 5.0

# Description
Guess or try xxxxx in flag and replace to the correct word.
xxxxx is uppercase.
No need decipher the password of xxxxx.zip.
**lost_data.zip**

# Hint
Refer the file contents of xxxxx.zip.
filesystem is answer.

# Solution
```
$ unzip lost_data.zip
Archive: lost_data.zip
creating: lost_data/
inflating: lost_data/.DS_Store
creating: __MACOSX/
creating: __MACOSX/lost_data/
inflating: __MACOSX/lost_data/._.DS_Store
inflating: lost_data/data.zip
inflating: __MACOSX/lost_data/._data.zip
inflating: lost_data/xxxxx.zip
inflating: __MACOSX/lost_data/._xxxxx.zip
inflating: __MACOSX/._lost_data
```

We see that we now have two more **.zip** files, xxxxx.zip and data.zip in the lost_data folder

If we extract both zip files we get the following:
```
$ unzip data.zip
Archive: data.zip
**SNIPPED FOR BREVITY***
creating: data/
inflating: data/1
inflating: data/3
inflating: data/2
```

Examinig the three binary files 1,2,3 reveals strings that resemble PNG files.
```
$ strings 1
IHDR <------
PLTE}
$IDAT8 <------
"O*3
'F{
#'3i
J^`eR
IEND <------
```

However, it appears the PNG magic bytes are missing. We can fix this by replacing the 1st 8 bytes in each file with the following eight bytes:

**89 50 4E 47 0D 0A 1A 0A**

and save each file so that it becomes a valid PNG image.

Each valid PNG image produces a QR Code such as

![](https://imgur.com/H2ERqyO.png)

Fixing all three files and scanning their respective QR codes reveals the flag to be: **HarekazeCTF{Y0u_G0t_FuNNy_F1ag_?DF?_T?_is_xxxxx}**

Referring to the hint given, we need to "guess" what xxxxx is based on the filesystem of xxxxxx.zip and using only uppercase. We tried FAT16 and FAT32, the latter of which is correct. Hence, the final flag is

**HarekazeCTF{Y0u_G0t_FuNNy_F1ag_?DF?_T?_is_FAT32}**