The Compressed Truth
Introduction:
ASHVAULT was never the destination. It was the key. The operational brief recovered from ASHVAULT’s search index pointed deeper — to Veylen Marr’s inner node, the machine where the Shard Reference custody chains sleep behind his personal credentials. CROWQUILL used what the brief called an unverified password — lifted through a Suncourt intermediary — to authenticate as vmarr and walk through the inner door. No forced entry. No broken locks. Just a stolen name presented at the right threshold, and the machine believed it. What the operative found inside was worse than Cassian had hoped for. The Shard Reference 7 custody chain was there — a full record of where the Greywater Fragment had moved since the night the Signet shattered, whose.
Description:
The unverified password got CROWQUILL through the door. What the registry shows is everything after. 2026-06-18 13:15:15; KeeFarce hits the disk, a tool built to lift KeePass’s master password straight from process memory before it could be locked away. From there, oath_records_cinderbound_vol2.zip was enumerated down to saltoaths_secretive, the stolen records were staged at C:\Users\Public\Music\saltwork, and sealed into shardchain.tar for exfiltration. Somewhere in shard_storage\ShardKeepass_FirstMark sat the one file worth more than the rest, not a fragment of the custody chain, but the key to all of it. The trail ends at C:\Users\vmarr\Desktop\working, the last folder CROWQUILL touched before vanishing. The machine never knew the difference, it just kept faithful time, the way registries always do.
Investigating the Challenge files:
Download the challenge zip file and unzip it:
1┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
2└──╼ $unzip chal.zip
3Archive: chal.zip
4 creating: C/
5 creating: C/Users/
6 creating: C/Users/cyberjunkie/
7 inflating: C/Users/cyberjunkie/NTUSER.DAT
8 inflating: C/Users/cyberjunkie/ntuser.dat.LOG1
9extracting: C/Users/cyberjunkie/ntuser.dat.LOG2
10 creating: C/Users/Default/
11 inflating: C/Users/Default/NTUSER.DAT
12 inflating: C/Users/Default/NTUSER.DAT.LOG1
13 inflating: C/Users/Default/NTUSER.DAT.LOG2
14 creating: C/Users/vmarr/
15 inflating: C/Users/vmarr/NTUSER.DAT
16 inflating: C/Users/vmarr/ntuser.dat.LOG1
17 creating: C/Windows/
18 creating: C/Windows/System32/
19 creating: C/Windows/System32/config/
20 inflating: C/Windows/System32/config/DEFAULT
21 inflating: C/Windows/System32/config/DEFAULT.LOG1
22 inflating: C/Windows/System32/config/DEFAULT.LOG2
23┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
24└──╼ $
Looks like a registry forensic challenge. No SAM/SYSTEM/SECURITY, no memory dump.
Lets check the hives with RegRipper:
┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
└──╼ $regripper -r C/Users/vmarr/NTUSER.DAT -f ntuser > vmarr_report.txt
Parsed Plugins file.
[...]
┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
└──╼ $regripper -r C/Users/cyberjunkie/NTUSER.DAT -f ntuser > cyberjunkie_report.txt
Parsed Plugins file.
[...]
┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
└──╼ $regripper -r C/Users/Default/NTUSER.DAT -f ntuser > default_report.txt
Parsed Plugins file.
[...]
┌─[ballademageren@parrot]─[~/jutlandia/HTB_CA2026/The_Compressed_Truth]
└──╼ $regripper -r C/Windows/System32/config/DEFAULT -f ntuser > defaulthive_report.txt
Parsed Plugins file.
[...]
Investigate the files.
The file necessarily for our flags is vmarr_report.txt.
The Seventh flags:
The First flag:
CROWQUILL did not break the lock — they took the key while it was still held. A tool was brought for one purpose: extract secrets from memory before they could be put away. What is its name?
In vmarr_report.txt:
7-Zip's History
----------------------------------------
sevenzip v.20210329
- Gets records of histories from 7-Zip keys
FM LastWrite: [2026-06-18 13:26:47Z]
Compression LastWrite: [2026-06-18 13:25:06Z]
Extraction LastWrite: [2026-06-18 13:15:15Z]
FM\PanelPath0: c:\users\vmarr\desktop\working\
Compression\ArcHistory:
C:\Users\Public\Pictures\shardchain.tar
Extraction\PathHistory:
C:\Users\vmarr\AppData\Local\Temp\writ\KeeFarce\
FM\CopyHistory:
c:\users\public\music\saltwork\
c:\users\public\music\saltwork
FM\FolderHistory:
[...]
c:\users\public\music\saltwork\
c:\users\vmarr\appdata\Roaming\KeePass\
[...]
C:\Users\vmarr\Documents\Registry\shard_storage\ShardKeepass_FirstMark\
[...]
C:\Users\vmarr\Documents\Registry\oath_records_cinderbound_vol2.zip\
C:\Users\vmarr\Documents\Registry\oath_records_cinderbound_vol2.zip\oath_records_cinderbound_vol2\
C:\Users\vmarr\Documents\Registry\oath_records_cinderbound_vol2.zip\oath_records_cinderbound_vol2\saltoaths_secretive\
[...]
Software\Wow6432Node\7-Zip not found.
----------------------------------------
Typed paths:
----------------------------------------
typedpaths v.20200526
(NTUSER.DAT) Gets contents of user's typedpaths key
Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
LastWrite Time 2026-06-18 13:20:32Z
url1 C:\Users\Public\Music\saltwork
----------------------------------------
The Extraction\PathHistory contains KeeFarce which is a tool that dumps KeePass master password and database content directly from the memory.
Flag:
KeeFarce.
The Second flag:
The Registry keeps time as faithfully as it keeps names. The moment CROWQUILL’s tool first touched the system is preserved in the artifact. When was the tool extracted? (YYYY-MM-DD hh:mm:ss)
Look at vmarr_report.txt under sevenzip again it has the Extraction LastWrite: [2026-06-18 13:15:15Z] from when the zip extracted KeeFarce.
Flag:
2026-06-18 13:15:15
The Third flag:
One archive file caught the operative’s eye during enumeration, its contents inspected before staging began. What is the deepest folder that was enumerated inside the archive file?
Look at vmarr_report.txt under FM\FolderHistory we will see the deepest folder C:\Users\vmarr\Documents\Registry\oath_records_cinderbound_vol2.zip\oath_records_cinderbound_vol2\saltoaths_secretive\.
Flag:
saltoaths_secretive
The Fourth flag:
Before exfiltration comes collection — files pulled from their places and gathered where the operative controls. Where did CROWQUILL stage the stolen records?
Look at vmarr_report.txt under FM\CopyHistory and typedpaths. Both points at C:\Users\Public\Music\saltwork.
Flag:
C:\Users\Public\Music\saltwork
The Fifth flag:
The stolen records were compressed and sealed for the journey out — made small enough for channels that do not ask questions. What is the name of the archive prepared for exfiltration?
If we look at vmarr_report.txt under Compression\ArcHistory, it only gives us C:\Users\Public\Pictures\shardchain.tar
Flag:
C:\Users\Public\Pictures\shardchain.tar
The Sixth flag:
One file above all others — holding keys to every shard, every custodian, every oath. Whoever holds this holds the right to reconstruct authority older than any crown. Where was it stored?
If we look in vmarr_report.txt under FM\FolderHistory we see ShardKeepass_FirstMark under shard_storage which seems fitting.
Flag:
C:\Users\vmarr\Documents\Registry\shard_storage\ShardKeepass_FirstMark\
The Seventh flag:
When staging was complete and the archive sealed, the trail ends in one folder — where enumeration stopped. Where did CROWQUILL conclude their operations while using the 7zip?
In vmarr_report.txt under sevenzip we can see that the last path for 7-zip can be found under FM\PanelPath0.
Flag:
c:\users\vmarr\desktop\working\
Completion:
