> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/forensic-exercises/image-forensics/unswirl-image.md).
# Unswirl Image
### 1. Introduction
Imagine you get an Image like this which contains a text. But the image is digitaly distored and you should find a way to made it readable.\
I’ve tried to solve a particular challenge of a CTF Game and the final flag was masked like this :sunglasses:
### 2. The Challenge
The challenge contained a file without file extension. It's a pdf file and I'll add it here:
{% file src="/files/16aXnhv9JabDL4ora5ko" %}
Challenge File
{% endfile %}
### 3. Analysis
Open that file in a texteditor shows a signature of a pdf file:
A recheck with the tool [TrIDNET](http://mark0.net/soft-tridnet-e.html) confirms that the signature match a pdf file:
The pdf file contains a image with a cartoon character and the text: **I dare you find it!** :smile:
For the further analysis I've used a free tool called [Winking PDF Analyzer](https://www.winking.be/en/products/pdfanalyzer)
A quick view shows that the pdf file contains streams. My assumption was that there is something hidden in that streams and I’ve tried to find a way to decode them.
On [stackoverflow](https://stackoverflow.com/questions/27997930/how-to-decode-a-pdf-stream) I did find a hint howto decode them:
> The easiest way to decode a PDF file is to use a tool intended to do it, for example [MuPDF](https://mupdf.com) can do this with „`mutool clean -d