Journal_Necromancy

SR

An engineer wiped their tracks before a seized workstation was handed back, but a small partition got imaged first. On that image is an encrypted archive we think holds what they took, and the key that opens it was deliberately destroyed before the machine was seized. Recover what you need, open the archive, and read it. The contents are the flag.

You are given a single 64 MiB NTFS raw image, evidence.img. The flag is in isfcr{...} format.