PicoCTF Redaction Gone Wrong Writeup: When PDF Redaction Is Only Visual
A picoCTF forensics walkthrough showing why visual PDF redaction can still leave text recoverable.
PicoCTFForensicsPDF
Redaction Gone Wrong is a picoCTF 2022 forensics challenge about a common document handling mistake: covering text visually without actually removing the underlying content.
Challenge Overview
The provided PDF appears to contain redacted information. The trick is that some redactions are not true redactions; they are only visual overlays.
Recovery
Opening or selecting the hidden text reveals the sensitive value that should have been removed from the document.
Key Takeaways
- Real redaction must remove content, not just place a shape over it.
- PDFs can preserve selectable text under visual overlays.
- Always verify redacted documents by attempting text selection, copy-paste, and metadata inspection.