Registry

do not try to crack anything user wise use grep and look forensics wise at your d*r p and when u overlay to something useful you will see the mess of the ctf like setup he talks about