# EVIDENCE
```A buddy of mine is in serious trouble. He works for the feds and accidentally deleted a pendrive containing crucial evidence
Can you get it back and tell us what the evidence is?
We need to know what the suspect bought```
- File : [evidence.zip](https://github.com/Pynard/writeups/raw/main/2020/BRIXEL/attachements/evidence/evidence.zip)
First we unzip the archive to find an img file :
```$ file evidence.imgevidence.img: DOS/MBR boot sector, code offset 0x52+2, OEM-ID "NTFS    ", sectors/cluster 8, Media descriptor 0xf8, sectors/track 63, heads 255, dos < 4.0 BootSector (0x0), FAT (1Y bit by descriptor); NTFS, sectors/track 63, physical drive 0x80, sectors 1880044, $MFT start cluster 78335, $MFTMirror start cluster 2, bytes/RecordSegment 2^(-1*246), clusters/index block 1, serial number 0a6822852822828ef; contains bootstrap BOOTMGR```
This img seems corrupted, as shown with fdisk :
```$ fdisk -l evidence.imgPériphérique   Amorçage   Début      Fin  Secteurs Taille Id Typeevidence.img1  1920221984 3736432267 1816210284   866G 72 inconnuevidence.img2  1936028192 3889681299 1953653108 931,6G 6c inconnuevidence.img3           0          0          0     0B  0 Videevidence.img4    27722122   27722568        447 223,5K  0 Vide```
We'll use **photorec** to recover some deleted files and we get 2 wav files :
```$ ls recup_dir.1f0011328.wav  f0028304.wav```
- [f0011328.wav](https://github.com/Pynard/writeups/raw/main/2020/BRIXEL/attachements/evidence/f0011328.wav)- [f0028304.wav](https://github.com/Pynard/writeups/raw/main/2020/BRIXEL/attachements/evidence/f0028304.wav)
These are phone calls between Dorfmeister and a bot
We have to recover DTMF key press :
```$ multimon-ng -a DTMF -t wav f0011328.wav```
We get :
```212555424054666916092533266500018449903336667770844330222666222244466330227778844#2```
Some are numbers others are multi-tap letters, so lets convert it to text to see what we've got :
```A ALGAG JGOW M WAJEANJ THX FOR THE COCAINE BRUH```
So he clearly bought cocaine
flag : `brixelCTF{cocaine}`