Do you want to use dark theme?

Just In Time

Forensics, 375 points. 18 Solves. 

Time is running out, and we need your help! Our team has managed to recover a hard drive from a suspect's computer, and we think there may be information pertaining to the location of an upcoming meet. Unfortunately, the user almost certainly uses an encrypted messaging program when communicating sensitive info.

We're hoping to recover the address of the meet, which is the flag. Please enter just the street number and road, for example, 123 Easy Street. Also, to make the file download more manageable, we're giving you just the Users folder with some large (and irrelevant files) deleted.

You can download the Users folder here. You can also download at mirror2

Walkthrough

After unzipping the attachment, I realized it's the dump of a Windows user folder (ew, windows, disgusting). Regardless, we need to dig an address out of this blob of almost-1GB data. That's a lot. Where to start? Well, we know from the problem description that it's part of the chats of an "encrypted messaging program", oof. 

Regardless, I know nothing about Windows. A quick googling reveals that most of the programs' data are stored in the %APPDATA% folder, which in this case is Users/Xiang Zhi/AppData/Roaming. Ok, let's take a look. 

$ cd Users/Xiang Zhi/AppData/Roaming
$ ls 
Adobe		Microsoft	Mozilla		Notepad++	Wire		discord

Obviously, Wire is our "encrypted messaging program" in interest. And we know we are looking for an address, so...let's grep it? 

$ cd Wire
$ find . -type f -exec bash -c "echo -e \"\nSearching {}\"; strings \"{}\" | grep -E '\d{1,5}( [A-Z][A-Za-z.]+){2,5}' --color=always" \;

Upon some quick eyeballing of the output, we find

Searching ./IndexedDB/https_app.wire.com_0.indexeddb.leveldb/000004.log
content"^Meet me tomorrow at 6:27am for the drop. 933 English Muffin Way. Make sure you aren't followed"
content"^Meet me tomorrow at 6:27am for the drop. 933 English Muffin Way. Make sure you aren't followed"

Huh. Interesting. Looks very sus. "933 English Muffin Way" it is? 

Submitting the address reveals this is indeed the flag ヽ(・∀・)ノ We got 375 points in no time. Yay!