## [See original writeup on site](https://barelycompetent.dev/post/ctfs/2021-04-11-ritsecctf/#birdthief-fysa)

We're given no description, but an attachment file, which is a PDF.

In the PDF, there is some pages, of which the following seems to be the most important:


After trying to copy+paste the contents, thinking maybe the text was just in there but covered by the "redaction", I saw that it still did not copy the flag.

This make me thing that the flag was probably a picture underneath the redaction instead.

Using `foremost`, I carved all the files out of the PDF:

```
foremost BIRDTHIEF_FYSA.pdf
```

And in the resulting `output/` directory, we see about two dozen JPEGs. Of which, one is for our flag:


Flag is `RS{Make_sure_t0_read_the_briefing}`.