# information## Category - Forensics## Author - SUSIE
### Description: Files can always be changed in a secret way. Can you find the flag? cat.jpg
### Solution:The challenge gives us a link to download an image named "flag.jpg". Using exiftool to look at the exif data of the image in our terminal we see some interesting data under"License".```zerodaytea@Patryk:/mnt/d/Coding/CTFs/PicoCTF2021/Forensics$ exiftool cat.jpgExifTool Version Number         : 11.88File Name                       : cat.jpgDirectory                       : .File Size                       : 858 kBFile Modification Date/Time     : 2021:03:16 10:37:17-06:00File Access Date/Time           : 2021:04:22 15:09:49-06:00File Inode Change Date/Time     : 2021:03:16 10:46:32-06:00File Permissions                : rwxrwxrwxFile Type                       : JPEGFile Type Extension             : jpgMIME Type                       : image/jpegJFIF Version                    : 1.02Resolution Unit                 : NoneX Resolution                    : 1Y Resolution                    : 1Current IPTC Digest             : 7a78f3d9cfb1ce42ab5a3aa30573d617Copyright Notice                : PicoCTFApplication Record Version      : 4XMP Toolkit                     : Image::ExifTool 10.80License                         : cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9Rights                          : PicoCTFImage Width                     : 2560Image Height                    : 1598Encoding Process                : Baseline DCT, Huffman codingBits Per Sample                 : 8Color Components                : 3Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)Image Size                      : 2560x1598Megapixels                      : 4.1```As this string of characters look like base64 we base64 decode it using either an online tool such as https://www.base64decode.org/ or using the terminal by outputting the string and piping it into the base64 tool with the parameter "--decode" as such:```zerodaytea@Patryk:/mnt/d/Coding/CTFs/PicoCTF2021/Forensics$ echo "cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9" | base64 --decodepicoCTF{the_m3tadata_1s_modified}```
### Flag:```picoCTF{the_m3tadata_1s_modified}```