← All writeups

The Disappearance of Owain Hughes

May 2026 · OSINT UK CTF · 14 challenges

The First Lead (2pts)

The Hughes family is deeply concerned. Their 19-year-old son, Owain, has abruptly left their home in Llandudno. While he had been mentioning a girlfriend in South Wales, his sudden silence and isolation have left his parents worried about his well-being.

As a Private Investigator, your first task is to review the initial evidence. We need to confirm the core facts from the family’s briefing and the recovered photos before we begin tracking his journey south.

Your Task: Review the attached PDF and images to confirm the missing individual’s full name, year of birth, and the city where he usually lives.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • The answer should be: Firstname_Surname_BirthYear_City

e.g. osintuk{John_Doe_2003_London}

Method: Not rocket science here. Download the ZIP folder and read ‘CASE FILES - OWAIN HUGHES.pdf’. Answers are in the memo block at the top. Flag: osintuk{Owain_Hughes_2006_Llandudno}

A Bittersweet Memory (4pts)

The Hughes family has provided a collection of photos recovered from Owain’s room, several of which depict a life they don’t recognise.

They were particularly confused by an image of Owain posing with a dog, noting that he has never been allowed to own pets. However, the most pressing lead comes from a different photograph, a printed picture with a specific date and a handwritten note scrawled across the front.

The message simply reads: “Our favourite spot… why did Kelly have to go?”

The family has no idea who or what “Kelly” refers to. To understand Owain’s movements and state of mind before he headed south, you need to find out exactly what happened at the location in this specific photo on that date.

Your Task: Identify the name of the entity Owain is referring to in his note.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • Remove all punctuation.
  • e.g. osintuk{Entity_Name}

Date: 7th Dec 2024 Note: ‘Talking Telescope’. Searched Google for “7th December 2024” (quoted search), ‘wales’ and ‘kelly’.

First result points to Llandudno (where Owain is from), pointing us to Kelly’s Ice Cream. Apparently Storm Darragh tore through it on that date. RIP.

Facebook link for the curious.

Flag: osintuk{Kellys_Ice_Cream}

The Drone Footage (2pts)

Since the family suspect that Owain has headed south, it has jogged their memory. They remembered a video he sent via WhatsApp during a previous visit to his girlfriend. Owain is a bit of a drone enthusiast; when his parents asked where he was, he simply sent back some aerial footage of the coast without actually naming the location.

The family have provided the video file in case it is relevant to his current whereabouts. They hope you can pinpoint the settlement where this was filmed to give us a starting point in the south.

Your Task: Identify the name of the village or settlement nearest to where this drone footage was taken.

Answer Format:

  • Use the osintuk{answer} format.
  • e.g. osintuk{Newton-on-the-Moor}

Note: Beach, river mouth goes into hill-based town. Clue: Example answer contains hyphens. Might the flag also? Solution: Screencapped the area with the most land visible, took it to lens.google.com. Came up with Ogmore Beach. Google Maps lists the area as ‘Ogmore-By-Sea’, matching the hyphen clue theory.

Flag: osintuk{Ogmore-By-Sea}

Static on the Line (5pts)

A worried friend of Owain’s from North Wales has come forward. He received a brief WhatsApp audio message from Owain just before the trail went cold. Recognising the potential importance of the message, the friend forwarded it to the family, who have now passed it on to you.

The message itself is in Welsh. Owain sounds calm, telling his friend: “Dw i’n iawn, paid â phoeni. Bydda i’n cysylltu’n fuan” (I’m okay, don’t worry. I’ll be in touch soon).

While the spoken words don’t appear to reveal much, it sounds like Owain sent this message as he was about to disembark from a train. We need to analyse the audio for any additional clues to determine exactly which station he might be at.

Your Task: Identify the specific train station Owain had arrived at when he sent this audio message.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.

  • Answer in Welsh.

  • e.g. osintuk{Llundain_Paddington}

Downloaded Audacity and imported the .mp3 in order to be able to hear the background audio clearer. I knew the context (getting off a train), so tried Google Translate for basic phrases in English-Welsh that could help understand. ‘Welcome to…’ is ‘Croeso i’, which helped. Used Overpass Turbo to identify every train station in Wales as listed on OpenStreetMap.

Saw there were plenty of results with ‘name:cy’ (‘Cymraeg’) in the dataset. I needed to filter down to get just the names from this, so I resigned that to being a job for Claude. I identified a ‘k’ consonant near the end so searched for that, and soon found ‘canolog’ for central. ‘Caerdydd Canalog’ (Cardiff Central) is on the list, and matches the answer.

Flag: osintuk{Caerdydd_Canalog}

Digital Footprint (5 pts)

With Owain now tracked to Cardiff, we need to see what he’s been doing in the city. While he was quiet on his “official” social media with family, he likely maintained a more private presence to stay connected with his new social circle.

People often include personal identifiers when creating usernames to make them easier to remember. When searching for a specific individual, it’s worth considering various combinations of their name and significant words or numbers.

You will likely need to experiment with several formats to find the right profile.

Your Task: Locate Owain’s X account and provide both his username and his unique numeric User ID.

Answer Format:

  • Use the osintuk{answer} format.
  • Use an underscore between the username and ID.
  • Do not include the @ symbol.
  • Format: osintuk{Username_NumericID}
  • e.g. osintuk{johnsmith _17895789324672}

Clue: Flag format has concatenated first name, underscore, and then numeric value. Raises possibility of ‘owainhughes_’ being a valid answer. Spoiler: it wasn’t. Significant words/numbers: 19 (dob), 2006 (birth year), 19052006 (birthday), 190506 (birthday). Steps: I initially tried Google for this, using site:x.com inurl:”owain hughes”, but with no luck. I ended up resorting to Twitter’s platform itself, trying ‘owainhughes’, ‘owain_hughes’ and combinations of the meaningful dates as listed in the case file (19, for his age, and 19th May 2006 for his birthday). I eventually found ‘owain_hughes06’ via this method, whose image matched one of the individuals depicted in the ‘HughesFamily.png’ file.

I then took the URL to twxpicker.com/user-id-finder , which provided his account’s numerical ID.

Username: owain_hughes06 Numeric user ID: 2015498369553055744

Flag: osintuk{owain_hughes06_2015498369553055744}

The Name Behind the Screen (2pts)

While reviewing Owain’s public X posts, you notice something important, a personal detail that strongly suggests who he has been spending time with since arriving in Cardiff.

Your Task: Identify the name of Owain’s girlfriend.

Answer Format:

  • Use the osintuk{answer} format
  • Use the name exactly as shown
  • No spaces or extra characters
  • e.g. osintuk{Anne}

This one’s a lot cleaner. Owain has a Strava post on his newly-identified Twitter account here, naming ‘Emina’ as his girlfriend.

Flag: osintuk{Emina}

The Coded Twist (10pts)

Following the latest developments in Cardiff, we have received a direct message from one of Owain’s close friends back home in North Wales. Owain had remained in occasional contact with this friend after leaving, but the messages became increasingly vague, as though he was worried someone else might see them.

To avoid the message falling into the wrong hands, the friend chose not to forward it to Owain’s parents directly. Instead, he contacted us privately, believing this information could explain why Owain ran, and why he is so determined to stay hidden.

The following transcript is taken from the message the friend sent to the investigator.

Message Transcript:

Hi, my name is Iestyn.

Owain’s parents told me you’re helping them to find him.
You must keep this to yourself, but Owain sent me a message.
He coded it because no one else can find out about this.
Find the right book and you’ll understand everything.]

4.6.1 / 12.14.2 / 16.53.3 / 19.14.1 / 21.3.3 / 32.2.1 / 7.7.3 / 14.9.1 / 19.20.6 / 26.4.1 / 34.6.4 / 50.1.1 / 40.29.3 / 29.1.2 / 39.24.6 / 44.19.4 / 28.19.1 / 41.1.2 / 50.35.4 / 55.35.1

(The transcript and code will be given as a TXT file – IestynsMessage.txt)

Your Task: Decode the message sent by Iestyn.

Answer Format:

  • Use the osintuk{answer} format
  • Replace any spaces with underscores
    e.g. osintuk{decoded_message_here}

Strikes me as being page/line/word. I remember the bedroom photo showing a book on his shelf. Currently praying they don’t want the Welsh edition.

Searching for the image via Google Lens reveals it to be The Goalie from Nowhere by Alan MacDonald. A quick search for online editions of the book found a digitised copy preserved in the Internet Archive.

Took a while, but I found the Welsh version available online to read for free https://www.ysgolglanrafon.co.uk/wp-content/uploads/2023/11/y-goli-o-nunlle.pdf

With this being a short children’s book, I decided to approach the cipher as page/word/letter as opposed to page/line/word. This made for an interesting exercise due to the unfamiliar language. While my initial cracking wasn’t quite correct (two letters were off), this gave enough to clearly highlight ‘abuse me not [s]afe’ - after which changing ‘FAIILY’ to ‘FAMILY’ was an easily-educated guess.

Flag: osintuk{FAMILY_ABUSE_ME_NOT_SAFE}

A Familiar Stop (3pts)

Investigator’s Update: The decoded message from Task #7 changes everything. We were hired to reunite a family, but the evidence now suggests that “home” may be the most dangerous place for Owain.

Ethically, we cannot provide his location to the clients (the parents) knowing this information. However, if we simply cease the investigation, they will likely hire another investigator, or worse, they may come looking themselves.

We must change our strategy. We need to find Owain before anyone else does, not to hand him over, but to warn him, ensure he has support, and verify his safety so we can close the case on our terms. We are pressing on, but our loyalty has shifted.

Owain has now resurfaced publicly through a shared running activity posted to his X account. The route appears to cover areas around Cardiff Central and through Bute Park, suggesting he is moving confidently around the city and is familiar with the area.

However, towards the end of the run, Owain appears to have stopped briefly at a specific shop before the activity ended.

Your Task: Identify the name of the location where Owain stopped near the end of his run.

Answer Format:

  • Use the osintuk{answer} format
  • Replace any spaces with underscores
    e.g. osintuk{location_name}

To complete this, we need to return to Owain’s tweet. Though the Strava link appears to be fake, the image itself shows a clear route alongside the River Taff in Cardiff.

Two terminal zones are visible, and we’re aware we’re looking for a shop. This appears to match the ‘Wood Street’ area, but it’s not precise enough. Backup plan then - time to see if there is a Strava account after all.

Logged on to a sock and found a matching account. This account has an activity that matches our sock, and the approximate creation date of this CTF.

Looking at the activity, we can see that Owain made a detour to Tesco Express (and potentially Greggs) at thee end of his run. The former of these is the flag.

Flag: osintuk{Tesco_Express}

Putting Together the Pieces (12pts)

After Owain’s stop at Tesco, his running activity ends abruptly at the nearby bus station. The sudden change in route suggests something may have happened immediately after his visit.

To investigate further, we went to the area and spoke with local witnesses. One person reported seeing a young couple having a disagreement outside the Tesco. The witness described the young man as visibly frustrated. Moments later, he stormed off towards the bus station and tore up the paper he was holding.

With help from the witness, we had a look around the area where he threw the paper and were miraculously able to recover the torn-up pieces. It appears to be a receipt.

Your Task: Reconstruct the attached torn receipt and extract the following information:

  • The last 4 digits of the card used to pay
  • The Clubcard points balance

Answer Format:

  • Use the osintuk{answer} format
  • Enter the credit digits then Clubcard balance, separated by an underscore.
    e.g. osintuk{8317_21}

First step, I did as all of us would do - I asked AI to have a go. My hope was that it would be able to identify the text within via OCR and to then complete a reconstruction based on a template of a Tesco receipt. While it did put up a valiant effort, it was just a bit too much for Claude to crack.

This took quite a long time to do. I manually screenshotted each piece of receipt, removed the background, and then reconstructed the receipt.

Last 4 digits of card: 0218 Clubcard balance: 56

Flag: osintuk{0218_56}

The Gatekeepers (6pts)

Following the heated argument outside the station, the witness felt uneasy leaving the young woman alone. She decided to follow at a distance as the woman walked away from the Tesco and towards the entrance of a modern apartment building around the corner.

Seeing her fumble for her keys outside the entrance, the witness approached briefly to check she was okay. The woman brushed it off, muttering that she was fine and just wanted to get inside. As she held her keys up to the electronic fob reader, the witness caught a glimpse of a small plastic tag hanging from the keyring with the number 701.

We now have an apartment number, but we need a point of contact for the building itself. It is the block located opposite Black Sheep Coffee on Wood Street. To proceed, we need the details of the registered Managing Agent responsible for this property.

Your Task: Identify the Name and License Expiry Date of the agent connected to this building.

Answer Format:

  • Use the osintuk{answer} format. - Replace any spaces with underscores (e.g., Example_Agent_Ltd).
  • Separator: Use a hyphen - to separate the name and the date.
  • Date: Use the format DDMMYYYY (no slashes).
    e.g. osintuk{Agent_Name_Ltd-DDMMYYYY}

The Black Street Coffee is opposite Wood Street House. Google has a link to their site. A link to the agent licence is available at the bottom of the website, naming Urbanbubble Ltd as the managing agent. The document is also furnished with the necessary date information.

Flag: osintuk{Urbanbubble_Ltd-12042028}

Hidden in Plain Sight (7pts)

We now have a confirmed lead on the apartment building opposite Black Sheep Coffee, as well as the registered managing agent responsible for the property. With this information, we attempted to make contact and progress the investigation further.

Unfortunately, the managing agent refused to provide any details regarding tenants or occupants within the building, citing privacy and security reasons.

We then attempted to buzz the apartment directly. There was no answer.

At this stage, we cannot confirm whether Emina is currently inside the property, or whether she has left the area since the incident. With Owain’s whereabouts still unknown, making direct contact with her is now critical.

We need another way in. Is there any way we can identify her phone number?

Your Task: Look back through the evidence so far to see if there is anything we’ve missed that reveals a phone number.

Answer Format:

  • Use the osintuk{answer} format.
  • Enter the number without a + so it begins “07…”
    e.g. osintuk{07123456789}

Clue: The name of the task is ‘hidden in plain sight’. I’m not expecting this to require multi-step investigations, but careful observation of what information has already been supplied.

Compiled the evidence and examined closely. Checked the dog photo - observed the collar.

Bingo.

Flag: osintuk{07700900726}

The Quiet Place (12pts)

After progressing the investigation to the apartment building opposite Black Sheep Coffee, we attempted to make contact with Owain’s girlfriend. With no response at the door and no way to confirm whether she was inside, we reviewed the evidence again and located Emina’s phone number.

We managed to reach her directly and arranged to meet her back at her apartment later that day to discuss what had happened.

When we spoke, she appeared shaken and insisted she did not know where Owain went after the argument outside Tesco. According to her, Owain left the area immediately, heading into the bus station and disappearing from view. His whereabouts are currently unknown.

However, she did provide one crucial detail.

Emina explained that this is not the first time Owain has needed to be alone. On a previous occasion when he felt overwhelmed, he mentioned that there is a particular place he goes to unwind, somewhere quiet, away from people, where he can clear his head.

She said Owain had referenced this spot before as somewhere he goes when he needs space to think. In the past, Owain sent her an image of the location, but he never told her exactly where it was.

Emina has now forwarded that same photo to us, but she is unable to confirm where it was taken.

Your Task: Identify the location shown in the image so we can locate Owain and confirm his wellbeing.

Answer Format:

  • Use the osintuk{answer} format.
  • Enter the name of the person in the statue.
  • Replace any spaces with underscores.
    e.g. osintuk{John_Smith}

AFTER SOLVING THIS QUESTION, PLEASE VISIT THE SOLUTION TAB TO CONCLUDE THE INVESTIGATION.

I started by putting the image into Google Lens. Initial results weren’t conclusive, so I added ‘Cardiff’ as a location marker. This appeared to show a statue of the same figure at the former Barry Dock Office. I found the building on Google Maps, and zoomed out to find the statue name - David Davies. A Street View check confirmed the statue to be in the same repose as our target, confirming it as the flag.

Flag: osintuk{David_Davies}

(Side Quest) What’s Occurin’? (3pts)

While reviewing Owain’s X profile, something in his biography stands out. It doesn’t look like a standard personal description… Instead, it reads more like a specific reference or a quote lifted from popular culture.

Your Task: Identify the origin of the reference used in Owain’s profile biography.

Answer Format:

  • Use the osintuk{answer} format
  • Replace any spaces with underscores
    e.g. osintuk{Not_Going_Out}

The eagle-eyed amongst you might have spotted Gavin and Stacey playing on Owain’s laptop in the ‘bedroom’ photo, which just so happens to be our flag here. If not, a simple search for his Twitter bio finds the answer quick enough.

Flag: osintuk{Gavin_and_Stacey}

The Vanished Mansion (6pts)

While investigating the area near the drone footage, you might stumble upon the history of a grand estate that once dominated the cliffs. This was Dunraven Castle, a massive mansion that fell into ruin after the family who owned it faced staggering debts and “death duties” (inheritance taxes). Rather than selling it, the structure was largely stripped and eventually dynamited in the mid-20th century. Today, only the walled gardens and the building’s stone “footprint” remain.

To earn these bonus points, you must look back at the mansion’s peak. In 1888, architectural plans were published by the architects Williams, West and Slade detailing grand additions to the house.

Your Task: Locate the 1888 ground floor plan for the Dunraven Castle additions. In the North-West wing, right next to a bedroom and dressing room, there is a specific private room with a curved bay window. What is the name of this room as written on the plan?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.

e.g. osintuk{drawing_room}

An image of the plans, though low-res, is available on Abe Books. It requires significant ‘zoom/enhance’, but reveals the name ‘own room’. Flag: osintuk{own_room}