Ghost Coordinates

Forensics, Hard, 500 pts

FLAG{GHOST_ATOLL_14.4783S_138.2600W}

The S/V Obsidian Siren's GPS track, AIS log, deck logbook, photo EXIF, a sqlite navigation backup, and a scanned map were all recovered. The captain deliberately salted the record with two layers of deception, both described and named in captain_navigation_notes.txt, which also gives the flag's exact template: FLAG{<LOCATION_NAME>_<LAT>_<LON>}.

Decoy 1 — the purge point. navigation_track.gpx and gps_history.csv both terminate at 14°57'S, 139°30'W. navigation_backup.db's system_audit_log table explains why: a TRACK_PURGE_COMMAND and RF_JAMMER_ENGAGED entry at 2026-10-19T22:14–22:15Z, tied to waypoint WPT_JAM_07 ("Purge Coordinate Point"). The main GPS track is a dead end by design.

Decoy 2 — the AIS diversion. An AIS beacon broadcast at 2026-10-18T19:40Z points to -16.78, -143.12 ("Devil's Reef"). system_audit_log tags it DECOY_TRANSMISSION, and waypoint WPT_DEV_05 is annotated outright: "DECOY DIVERSION: Old stash raided in 2021."

The real fix. The ship carried a backup Iridium-GLONASS receiver that kept logging after the main GPS was jammed. It recorded a landfall on 2026-10-20 at -14.478333, -138.260000 — "Ghost Atoll" / Isla del Fantasma. navigation_backup.db's waypoint WPT_GST_08 ("Ghost Atoll Sanctuary", category FINAL_CACHE) spells out the flag code directly, and route 103 ("PROJECT_GHOST_COVERT") shows the true path never touched Devil's Reef at all.

Six independent sources converge on the same coordinates and name, which is as verified as this kind of challenge gets:

• island_photo_03.jpg EXIF GPS: 14°28'42.00"S, 138°15'36.00"W (= -14.4783, -138.2600), description "Ghost Atoll landfall. The tide opens the cavern at midnight."
• ship_route_log.txt (deck logbook) records the same anchorage independently.
• visited_locations.csv has LOC_003_GHT "GHOST_ATOLL_SECRET_COVE" at the same coordinates, VERY_HIGH confidence, sourced from the stealth backup satellite.
• old_treasure_map.png's PNG tEXt metadata chunks state the target waypoint, target coordinates, an explicit decoy warning naming Devil's Reef, and even the flag format outright.
• The navigation database's own audit log, which labels entries DECOY vs FINAL_CACHE.

browser_history.sqlite and the two earlier-voyage photos weren't needed — their EXIF coordinates matched known early waypoints but didn't add anything decisive.