Summary
I designed this challenge for HackPrep, MMU’s first CTF, where 42 participants met metadata analysis with ExifTool and the basics of a forensic investigation. Players get a single file, usb_drive.img, described as a USB drive abandoned in a hospital parking lot. Inside is a small story told through emails, letters and clinical documents, and three escalating hints that point to the one place the flag lives: the metadata of an X-ray image.
The goal
A beginner challenge should teach one transferable idea. Mine was that a file can say far more than its visible content, and that an investigator reads everything before reaching for a tool. I wanted players to succeed by following evidence, not by guessing or by knowing a trick.
The scenario
The brief reads like a case file: a USB drive, fragments of a private life, and a diagnosis someone tried hard to keep quiet. The story is fictional and told only through the documents, so there is nothing to look up outside the image. Players piece together a patient’s symptoms, referral and diagnosis, and that story is the trail that leads to the flag.
What is on the drive
The image is a 40 MB FAT16 volume. Its contents, in the order a player should read them:
- Two emails between a patient and his doctor. The second asks the patient to review the attached scan carefully, because the imaging file holds all the reference codes.
- A referral letter (Word document) from the clinic to a neurology centre.
- Test results (PDF), including a note that the case reference identifier comes with the radiological imaging file.
- Case notes (PowerPoint) from the specialist.
- A specialist letter (PDF) confirming the diagnosis. It says outright that the official case reference is embedded in the scan’s metadata.
- The X-ray (PNG), which carries the flag.
The image also ships a portable copy of ExifTool, so a player on any machine has the tool they need once they know to look.
The clue chain
I wanted the hint to grow stronger the further a player read, so nobody is stuck with no direction. It starts vague and ends explicit:
- The doctor’s email says the imaging file contains the reference codes.
- The test results say the case reference identifier is enclosed with the imaging file.
- The specialist letter says the reference is embedded in the scan’s metadata.
By the third document, a player who has read everything has been told three times to look at the image, and the third time to look inside it.
Where the flag is hidden
The flag sits in the PNG’s text metadata, in the Comment field, alongside an Artist and a Copyright entry that make the file look like a real clinical image. I kept an untouched copy of the X-ray without those fields, so I could compare the two files and confirm the only difference was the metadata I added. The visible picture is identical.
The intended solution
- Download
usb_drive.img. - Extract it with
binwalk -e usb_drive.img, or mount it. - Read every file in order: the two emails, the referral letter, the test results, the case notes, then the specialist letter.
- Run
exiftool images/xray.png. - Read the flag from the
Commentfield.
Design choices
Easy, on purpose. This was the first CTF many players had played, so the path had to be solvable by reading. Anything requiring a hard extra step would have hidden the lesson behind frustration.
A story instead of a puzzle. A narrative gives players a reason to read every file, and the documents carry the hints inside the fiction instead of as a separate clue sheet.
Repetition on purpose. Pointing to the same place three times is deliberate. For a beginner, being told twice is the difference between a challenge and a wall.