diff --git a/forensics/red/red.png b/forensics/red/red.png
new file mode 100644
index 0000000..9a9f59d
Binary files /dev/null and b/forensics/red/red.png differ
diff --git a/forensics/red/solve.sh b/forensics/red/solve.sh
new file mode 100755
index 0000000..951577d
--- /dev/null
+++ b/forensics/red/solve.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p zsteg
+
+zsteg red.png --strings longest | grep --only-matching -E "[A-Za-z0-9=/]+=+" | base64 -d | grep --only-matching -E "^picoCTF\{[^\}]+\}"