## [See original writeup on site](https://barelycompetent.dev/post/ctfs/2021-04-11-ritsecctf/#birdthief-fysa)
We're given no description, but an attachment file, which is a PDF.
In the PDF, there is some pages, of which the following seems to be the most important:
![](https://barelycompetent.dev/img/CTFs/2021/ritsecCTF/birdthief-cover.png)
After trying to copy+paste the contents, thinking maybe the text was just in there but covered by the "redaction", I saw that it still did not copy the flag.
This make me thing that the flag was probably a picture underneath the redaction instead.
Using `foremost`, I carved all the files out of the PDF:
```foremost BIRDTHIEF_FYSA.pdf```
And in the resulting `output/` directory, we see about two dozen JPEGs. Of which, one is for our flag:
![](https://barelycompetent.dev/img/CTFs/2021/ritsecCTF/birdthief-flag.jpeg)
Flag is `RS{Make_sure_t0_read_the_briefing}`.