[TryHackMe Writeup] The Letter – Full OSINT Walkthrough

[TryHackMe Writeup] The Letter – Full OSINT Walkthrough

[!NOTE]
This is a comprehensive, step-by-step CTF writeup for the "The Letter" OSINT challenge, demonstrating historical research, image analysis, and logical deduction to find the hidden postal code and the final flag.

Room Name: The Letter

Category: OSINT / Puzzle

Difficulty: Easy

🎯 Introduction & Objective

In this room, we step into the shoes of a postal worker. We intercept a battered, water-damaged letter containing a handwritten note and a torn newspaper clipping. Our objective is to piece together historical clues from these scattered fragments to answer two questions:

1. What is the postal code of the delivery address on the envelope?
2. What is the full name and age of the person mentioned in the note? (Flag)

Let’s dive into the investigation.

🔍 Step 1: Analyzing the Newspaper Clipping (Finding the Date)

Opening the zip file, we find a torn newspaper clipping from the French paper L'Ouest-Éclair. The main headline describing an event is torn, so we must rely on the surrounding articles to establish a timeline.

If we look closely at the secondary headlines, we see two massive clues:

1. "Amundsen a-t-il atteint le pôle Nord ?" (Has Amundsen reached the North Pole?)
2. "M. Herriot se déclare solidaire de M. Painlevé"

The Evidence: A quick search for Roald Amundsen North Pole airplane expedition yields the launch date of May 21, 1925. Corroborating this, Paul Painlevé served as the Prime Minister of France starting in April 1925.

We now know our mystery event took place in late May 1925.

⚓ Step 2: Identifying the Maritime Catastrophe

Now we can return to the torn main headline. We can read:

"Une catastrophe sur le [...] du Finistère"
"DEUX BATEAUX... ET DEUX CANOTS DE SAUVETAGE [...] noyés"

This translates to a disaster in the Finistère region involving two fishing boats and two lifeboats capsizing, with sailors drowning.

The Evidence: Knowing the date and the keywords, we perform a targeted OSINT search:

catastrophe Finistère canots de sauvetage mai 1925

[!TIP]
Using specific keywords in French based exactly on the clipping text drastically narrows down historical archives!

The first results point directly to the tragic Penmarc'h Lifeboat Disaster of May 23, 1925. During a freak storm, two SNSM rescue boats capsized while trying to save fishermen, resulting in the tragic deaths of 27 men. We have found our event.

📮 Step 3: Cracking the Postal Code

Our first challenge question asks for the postal code of the delivery address. Let's look at the outer envelope provided in the challenge files.

It is addressed to Édouard G. at the SNSM (Société Nationale de Sauvetage en Mer). Because the challenge revolves around his great-grandfather's heroics in Penmarc'h, it's highly logical that Édouard is stationed at the very same SNSM coastal station.

The Evidence: A quick lookup for the Penmarc'h postal code yields 29760.

[!WARNING]
The Rabbit Hole Trap: If you look closely at the blue ink scribbled over the torn holes on the envelope, it heavily resembles 53432. However, any seasoned OSINT investigator checking French postal codes knows that the first two digits indicate the department. Department 53 is Mayenne—a completely landlocked area with absolutely no sea rescue stations! The writer's sloppy cursive 29760 was simply distorted by water damage to look like 53432.

Answer 1: 29760

👤 Step 4: Uncovering the Identity for the Flag

We need to find the specific rescuer mentioned in Note.txt. The note reads:

"Ton arrière-grand-père n'avait même pas l'âge de passer le permis quand il s'est distingué ce jour-là. Le benjamin de l'équipe, et certainement pas le moins courageux."

The Evidence: The note reveals our hero was the youngest of the rescue team ("benjamin") and was too young to even have a driver's license (under 18).

[!IMPORTANT]
The legal driving age in France in the 1920s was 18, so we are looking for a teenager.

We can search historical archives of the Penmarc'h disaster for the youngest rescuer on the crews that day using a query like:

sauvetage penmarc'h 1925 "benjamin" ans mousse

The archives completely validate our theory: Yves-Marie Gourlaouen. He served as a mousse (cabin boy) on the rescue boats and went out into the deadly storm at the age of just 15 years old. He was awarded a silver medal of bravery for his actions.

🚩 Step 5: Formatting the Final Flag

The challenge requires the format THM{Name_Surname_age} and specifies: "only the first letter of the name and surname should be capitalised."

However, they give us a formatting example: THM{Pierre-Henry_Lagaffe_23}. Notice how both parts of the hyphenated first name retain their capitalization (P and H). Following this exact structural rule provided by the room creator, we map our hero into the flag format.

Answer 2: THM{Yves-Marie_Gourlaouen_15}

🏆 Conclusion

This was a fantastic OSINT room that beautifully stringed together real-world historical archives with deductive reasoning. It highlighted the importance of verifying visual clues (like validating post codes geographically) rather than just trusting messy handwriting at first glance.