> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2024/picoctf-2024/forensics/dear-diary.md). # Dear Diary https\://play.picoctf.org/practice/challenge/413?originalEvent=73\&page=4 **Description** If you can find the flag on this disk image, we can close the case for good! Download the disk image [here](https://artifacts.picoctf.net/c_titan/63/disk.flag.img.gz). First, given that its a disk image, we can try running strings on the file, while searching for "pico"

As we can see, there was nothing useful. However as my team was solving this challenge, my teammate sent me the following picture,

This got me thinking that maybe the flag would be in a .txt file as the challenge did have a "Diary" in its name and there were some .txt files. I searched for flag.txt, with nothing showing up, tried flag as well, but still nothing. Finally, I tried very generically, ".txt" and from there I found that were 32 hits on .txt... ![](https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FHEyWdCV2bEAQ6vV2xQGT%2FScreenshot%202024-03-28%20at%205.40.25%20PM.png?alt=media\&token=a4e261af-6806-44e9-bb0c-d8bf55421855) By looking through each file.txt and combining the relevant parts of the flags, we can obtain the flag ``` picoCTF{1_533_n4m35_80d24b30} ```