added cscamp ctf 2013 forensics2 writeup