KringleCon 2018 - Lethal ForensicELFication

Lethal ForensicELFication was another very easy challenge that demonstrated how vim stores its history.

This challenge was definitely designed for beginners - and there's nothing wrong with that! It was still a fun challenge that reminds us to be cognizant about where applications store data and history and what kind of information is kept.

Accessing the Challenge

As with most of the challenges up to this point, you always want to talk to the NPCs to unlock hints and get further direction on the challenges.  Talk to Tangled Coalbox and you'll receive a hint that will lead you in the right direction.  Once you access the challenge, you will be taken to a terminal with the following message:

Christmas is coming, and so it would seem,
ER (Elf Resources) crushes elves' dreams.
One tells me she was disturbed by a bloke.
He tells me this must be some kind of joke.

Please do your best to determine what's real.
Has this jamoke, for this elf, got some feels?
Lethal forensics ain't my cup of tea;
If YOU can fake it, my hero you'll be.

One more quick note that might help you complete,
Clearing this mess up that's now at your feet.
Certain text editors can leave some clue.
Did our young Romeo leave one for you?

- Tangle Coalbox, ER Investigator

The goal of this challenge is to find out the name for whom the love poem on the system was written.

VIM History

Talking with the Tangle Coalbox NPC, you'll be awarded a hint in the form of a URL link for Forensic relevance of Vim Artifacts.  This site will explain vim and some of its components when it comes to forensic analysis.  Using what I learned from this site, I decided to check to see if a file named .viminfo existed on the machine.

Sure enough, there is was! So I used cat to read the contents of the file.  Scrolling through the output, I found mention of the name Elinore.  Given that this was the only name I could find, I tried submitting it as the answer and got it right!

Also, if you're familiar at all with Edgar Allen Poe's The Raven, you probably caught on that the "Nevermore" referenced in the motd is used throughout his poem.  Elinore is very similar to Lenore from The Raven.

Conclusion

This one was by far the easiest save for Essential Editor.  It was still fun to play and reminded me of how important it is to be aware of history files and the information they may contain.