public@themctf:~$

THE FORGOTTEN INVENTORY

In the summer of 2007, a massive archive quietly surfaced - a meticulous ledger of items that once rolled across desert sands under foreign command. The file was structured, line after line, page after page, each entry tied to a unit whose

osint2025
views
-
writeup by
pavel?!
published
07 November 2025

SOLVE NOTES

Original on GitHub

Challenge

The challenge hinted at a leaked dataset from the Iraq War, describing a huge CSV file containing equipment inventories from Operation Iraqi Freedom (OIF). It mentioned 1,996 pages of entries and a government official trying to take the archive down. This clearly referenced an incident around 2007, when U.S. military supply data was leaked online.


Step 1 --- Initial Analysis

The first clues pointed toward a CSV file and a takedown request about a military equipment list. Searching terms like:

Operation Freedom 1996 pages csv site:archive.org
"Iraq" "equipment" "FORSCOM" "csv"

brought up an old mirror of Iraq OIF Property List.csv hosted on data leak archives (and mentioned in Reddit / OSINT circles).


Step 2 --- Digging Deeper

Opening the archived metadata for that CSV on Archive.org revealed an attached notice under takedown correspondence. It contained a formal U.S. Army message titled:

"Request to remove sensitive file Iraq OIF Property List.csv"

The sender was listed as:

CW2 David J. Hoskins (FORSCOM)
Email: david.j.hoskins@us.army.mil

The message was essentially a digital plea to have the dataset removed due to sensitivity of internal logistics information, confirming he was the gatekeeper referenced in the challenge.


Step 3 --- Solution

After verifying the authenticity of the message and that the archive remained public, the final answer became clear:

v1t{david.j.hoskins@us.army.mil}

Flag

v1t{david.j.hoskins@us.army.mil}

Notes

This was a classic OSINT sleuth - starting from a narrative reference to a historical leak (Operation Iraqi Freedom logistics data), correlating the 1,996-page clue to the CSV dump, then locating the U.S. Army takedown request on public mirrors. It’s a nice callback to how transparency archives sometimes preserve even the takedown attempts themselves.