Windows forensics CTF (hard)

Solved a multi-stage credential-recovery chain — DPAPI decryption through to a VeraCrypt volume — by hand-rolling the cryptographic steps in Python and carefully inspecting the recovered output for the flag.