The Captain's Last Log

Forensics, Medium, 200 pts

FLAG{v4nc3_s1l4s_d34d_m4ns_c4y_s3cr3t_1723}

The only file is captain_disk.E01. There are no EWF tools on my box, so I read it directly. The volume section gives 64 sectors per chunk at 512 bytes, and the table section lists zlib-compressed chunk offsets. Inflating every chunk produces a 64 MiB raw image:

for o, compressed in table:
    out.write(zlib.decompress(raw) if compressed else raw)

The image has one NTFS partition starting at sector 2048, volume label BLACK_TIDE. 7z l lists the normal files (journals, crew roster, ship logs) but not the captain's final entry. strings on the partition still finds it in free space. It says the entry is Vigenere-encrypted with:

KEY = <NIGHT_WATCHWORD><VOLUME_LABEL>

The watchword for 23 November 1723 is LEVIATHAN, from Navigation_and_Logs/ship_logs_autumn_1723.txt. The volume label is BLACK_TIDE. The label contains an underscore, so the key letters are LEVIATHANBLACKTIDE.

Decrypting with the key advancing only on letters (case and punctuation untouched) gives the confession with the coordinates 18 21 44 N, 64 31 18 W and the flag. If the key also advances on non-letters, the output is garbage after the first word, which is an easy trap to fall into. The first few letters already decrypt to "The", which is how I checked the key was right.