Category: Forensics Flag: dalctf{h3h3_i_s2_p41nt} Overview We're given a packet capture. The capture turns out to be a Linux USB HID (mouse) trace — the user held left-click and physically drew the flag on screen. The drawn text is ROT13-encoded, giving one extra layer of obfuscation. Reconnaissance file capture.pcap # pcap capture file, microsecond ts (little-endian) - version 2.4 # (Memory-mapped Linux USB, capture length 134217728) The link type is 220 ( LINKTYPE_USB_LINUX_MMAPPED ) — Linux U