use ftk-imager to get the github link and find their history to get the flag.