## History (Forensics)

### Solution

```
$ unzip J.zip
$ binwalk J
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3912330 0x3BB28A ARJ archive data, header size: 22472, version 1, minimum version to extract: 1, compression method: stored, file type: binary, original name: "1", original file date: 1970-01-01 00:00:00, compressed file size: 538968064, uncompressed file size: 1441792, os: MS-DOS
```

Since MS-DOS stores data in 16bits little endian, append `-el` to `strings` for searching, let's try some keywords:
```
$ strings -el J | rg "SEC"
$ strings -el J | rg "CON"
```

And will find something like,
```

Original writeup (https://github.com/jaidTw/ctf-writeups/blob/master/seccon-2018/history.md).