diff --git a/forensics/disko_1/solve.sh b/forensics/disko_1/solve.sh
new file mode 100755
index 0000000..aa0d3e8
--- /dev/null
+++ b/forensics/disko_1/solve.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+curl -s https://artifacts.picoctf.net/c/537/disko-1.dd.gz | gzip -d | strings | grep picoCTF