diff --git a/forensics/scan_surprise/flag.png b/forensics/scan_surprise/flag.png
new file mode 100644
index 0000000..e0f64ba
Binary files /dev/null and b/forensics/scan_surprise/flag.png differ
diff --git a/forensics/scan_surprise/solve.sh b/forensics/scan_surprise/solve.sh
new file mode 100755
index 0000000..095d7e7
--- /dev/null
+++ b/forensics/scan_surprise/solve.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash zbar
+
+zbarimg -q flag.png | grep -o 'picoCTF{.*}'
+