**Official Writeup**
**tl;dr**
+ Finding Chat application+ Extract unread message count from NTUSER.dat.+ Extract the last executed timestamp of the chat application.+ Extract the Version of the chat application.
Link to the writeup: [https://blog.bi0s.in/2021/08/16/Forensics/Ermittlung-InCTF-Internationals-2021/](https://blog.bi0s.in/2021/08/16/Forensics/Ermittlung-InCTF-Internationals-2021/)
Author: [g4rud4](https://twitter.com/_Nihith)