SANS Holiday Hack Challenge 2021 - Document Analysis

script.sh

#!/bin/bash
# Run exiftool on each docx file, print the file that was last modified by Jack Frost

for i in $(ls -l ~/*.docx | awk '{ print $9 }'); do
        exiftool $i | grep "Last Modified By" | grep "Jack Frost"

        if [[ $? == 0 ]]; then
                echo $i && exit
        fi
done