LAT writeups

notes / writeup

The Letter (THM Challenge)

$1

May 22, 2026 writeup

https://tryhackme.com/room/letter

Summary

The challenge provides three main artifacts: letter.png, Newspaper_clipping.png, and Note.txt. The goal is to recover the postal code on the envelope and identify the full name and age of the person mentioned in the note.

Core idea:

  • Note.txt says the target person was Edouard's great-grandfather, became known for an event on the water, and was the youngest member of the team.
  • The newspaper clipping is from L'Ouest-Eclair and points to a maritime disaster near Penmarc'h, Finistere, on 23 May 1925.
  • The award list after that disaster identifies the youngest matching rescuer as Yves-Marie Gourlaouen, a 15-year-old mousse.
  • The envelope context points to SNSM/Penmarc'h, and the French postal barcode confirms the postal code 29760.

Provided Files

letter.png
Note.txt
Newspaper_clipping.png
__MACOSX/._Newspaper_clipping.png
__MACOSX/._letter.png
__MACOSX/._Note.txt

The files under __MACOSX/ are AppleDouble metadata generated by macOS when the archive was created. They are not the main challenge data.

Recon

First, I listed every file in the challenge directory:

rg --files -uu

Relevant output:

letter.png
Note.txt
Newspaper_clipping.png
__MACOSX/._Newspaper_clipping.png
__MACOSX/._letter.png
__MACOSX/._Note.txt

Then I checked the file types:

file letter.png Note.txt Newspaper_clipping.png __MACOSX/._Newspaper_clipping.png __MACOSX/._letter.png __MACOSX/._Note.txt

Important output:

letter.png: PNG image data, 1448 x 1086, 8-bit/color RGBA, non-interlaced
Note.txt: Unicode text, UTF-8 text
Newspaper_clipping.png: PNG image data, 1021 x 397, 8-bit/color RGBA, non-interlaced
__MACOSX/._Newspaper_clipping.png: AppleDouble encoded Macintosh file
__MACOSX/._letter.png: AppleDouble encoded Macintosh file
__MACOSX/._Note.txt: AppleDouble encoded Macintosh file

I also checked the image dimensions:

identify letter.png Newspaper_clipping.png

Output:

letter.png PNG 1448x1086
Newspaper_clipping.png PNG 1021x397

Next, I inspected metadata:

exiftool letter.png Newspaper_clipping.png Note.txt

Useful observations:

  • letter.png: no useful hidden metadata.
  • Newspaper_clipping.png: contains User Comment: Screenshot, so it is probably a screenshot/crop of a newspaper source.
  • Note.txt: normal UTF-8 text file.

I also tried OCR with tesseract:

tesseract Newspaper_clipping.png stdout -l fra
tesseract letter.png stdout -l fra

That failed because tesseract was not installed in the environment:

zsh:1: command not found: tesseract

So the text extraction was done by manually reading the images, cropping useful regions, and using OSINT searches.

Step 1 - Read the Note

The note is in French. In English, it says roughly:

My dear Edouard,

Today, while tidying the attic at my grandparents' house, I found this old newspaper clipping.
Your great-grandfather was not even old enough to get a driver's license when he distinguished
himself that day. The youngest of the team, and certainly not the least brave.

He would be so proud to see you on the water in turn.

With all my affection,
Audette

Key clues:

  • The recipient is Edouard.
  • The person to identify is Edouard's great-grandfather.
  • He was not old enough to get a driver's license.
  • He was the youngest member of the team: the French note says le benjamin de l'equipe.
  • The event is connected to water or the sea: sur l'eau.
  • The note and newspaper are French, so the event is likely French or covered by French media.

This narrows the target: I should not look for a random victim. I need a very young person in a team that became known for bravery during a maritime event.

Step 2 - Analyze the Newspaper Clipping

Opening Newspaper_clipping.png, the following text is readable:

  • Newspaper title: L'Ouest-Eclair
  • Subtitle: Journal republicain quotidien
  • Side headline: Amundsen a-t-il atteint le pole Nord ?
  • Side headline: Les evenements du Maroc
  • Main torn headline, partially readable:
  • Une catastrophe ... du Finistere
  • DEUX BATEAUX DE PECHE
  • ET DEUX CANOTS DE SAUVETAGE
  • ... AU LARGE DE PENMARCH
  • ... hommes sont noyes

These fragments indicate a maritime disaster in Finistere involving two fishing boats and two rescue boats near Penmarc'h.

Useful OSINT search queries:

"Une catastrophe sur les cotes du Finistere" "deux bateaux" "deux canots de sauvetage"
"DEUX BATEAUX" "DEUX CANOTS" "Finistere" "L'Ouest-Eclair"
"catastrophe Finistere canots de sauvetage mai 1925"

The results match a KBC Penmarc'h page about the disaster of 23 May 1925:

  • The page has a section for L'OUEST-ECLAIR DU 24-05-1925.
  • The article title is Une catastrophe sur les cotes du Finistere.
  • The article text mentions DEUX BATEAUX DE PECHE, ET DEUX CANOTS DE SAUVETAGE, and AU LARGE DE PENMARCH.
  • The event happened at Penmarc'h, Finistere, Brittany.

Main source:

  • https://kbcpenmarch.franceserv.com/la-catastrophe-du-23-mai-1925-selon-la-presse-locale.html

This explains the note's sur l'eau clue: the person was connected to sailors, fishermen, or sea rescue during the Penmarc'h disaster.

Step 3 - Identify the Correct Person

After identifying the event as the Penmarc'h disaster on 23 May 1925, I searched the same historical source for the list of people who were credited or awarded after the rescue effort.

The note gives three constraints:

  • The person was part of the relevant rescue crew/team.
  • The person was the youngest member: benjamin.
  • The person was very young, below driving-license age.

On the KBC Penmarc'h page, the award list contains this entry:

Medaille d'argent de deuxieme classe. Gourlaouen Yves Marie*, 15 ans, mousse, inscrit au Guilvinec n 9397.

The page also includes a correction note:

Contrairement a l'annonce du journal, Gourlaouen Yves Marie, mousse, a 15 et non 25 ans, car ne en 1910.

Meaning: contrary to the newspaper announcement, Gourlaouen Yves Marie was 15, not 25, because he was born in 1910.

Another summary section also lists:

Medaille d'argent de deuxieme classe. Gourlaouen Yves, 15 ans, mousse.

Reasoning:

  • mousse means a young cabin boy/apprentice seaman, matching the youngest member clue.
  • Age 15 perfectly matches the note saying he was not old enough for a driver's license.
  • The source writes the name in French order as Gourlaouen Yves Marie.
  • For the challenge format Name_Surname_age, this becomes Yves-Marie_Gourlaouen_15.

The challenge example uses a hyphenated first name, {Pierre-Henry_Lagaffe_23}, so I kept the hyphenated first name style:

{Yves-Marie_Gourlaouen_15}

If the platform expects the TryHackMe prefix, the prefixed variant is:

THM{Yves-Marie_Gourlaouen_15}

However, the given prompt says the flag format is {Name_Surname_age}, so the answer is:

{Yves-Marie_Gourlaouen_15}

Step 4 - Recover the Postal Code

The first question asks:

What is the postal code of the delivery address on the envelope?

Opening letter.png, the envelope is a French La Poste LETTRE VERTE. The handwritten address is heavily water-damaged, but the visible parts suggest:

  • Recipient line: similar to Edouard G.
  • Organization line: SNSM
  • Lower address lines: torn and easy to misread.

SNSM is the French sea rescue organization, and the newspaper trail points to Penmarc'h. So a Penmarc'h postal code is already a strong candidate, but I still verified it with the envelope barcode.

To inspect the handwritten address, I cropped and enhanced the address area:

convert letter.png -crop 600x330+520+450 -resize 1800x990 address_crop.png
convert letter.png -crop 520x280+600+450 -colorspace Gray -normalize -sharpen 0x2 -resize 2080x1120 address_gray.png

The handwriting alone is dangerous to trust because water damage and holes distort the blue ink. It can look like a different number if read directly.

The bottom-right edge of the envelope also has the orange French postal barcode. I cropped that region:

convert letter.png -crop 600x160+790+780 -resize 2400x640 barcode_crop.png
convert letter.png -crop 620x180+780+760 -resize 2480x720 barcode_full.png

According to the French postal barcode format:

  • The orange barcode is printed at the bottom-right edge of the envelope by La Poste sorting machines.
  • The right-hand series encodes the postal code or Cedex code.
  • The barcode is read from right to left.
  • Each digit has its own bar/blank pattern.

Reference:

  • https://fr.wikipedia.org/wiki/Code-barres_postal_fran%C3%A7ais

Reading the right-hand series from right to left gives:

29760

Detailed barcode decoding:

In the routing-code table, each digit is represented by six positions. I use | for a printed bar and . for a missing bar. Since the postal barcode is read from right to left, postal code 29760 appears on the envelope from left to right as the groups 0 6 7 9 2:

Digit on envelope, left to right:   0      6      7      9      2
Pattern:                         ..|||| |.||.| ||..|| |||..| .||.||
Decoded right to left:              2      9      7      6      0

Combining the Decoded right to left digits:

29760

This also matches geographic OSINT:

  • Penmarc'h is in Finistere.
  • Finistere postal codes begin with department number 29.
  • The postal code for Penmarc'h is 29760.
  • La Poste's local page for Penmarch also shows 29760 PENMARCH: https://localiser.laposte.fr/finistere/penmarch/penmarch-291580

Therefore the postal code answer is:

29760

Important Pitfalls

Common mistakes in this challenge:

  • Do not trust the damaged handwriting too early. The blue ink is distorted by water damage and torn holes, so the number may look like something else.
  • A misleading read such as 53432 does not fit the context: department 53 is Mayenne, which is inland and does not fit a sea-rescue Penmarc'h/SNSM story.
  • Do not pick a random person named Gourlaouen. Multiple Gourlaouen entries appear in the historical source. The correct one is selected by the clues youngest, mousse, and 15 years old.
  • The old newspaper had an age mistake in one place, but the KBC Penmarc'h note corrects it: Yves Marie Gourlaouen was 15, not 25, because he was born in 1910.
  • __MACOSX/ does not contain the real clue; it is just archive metadata.
  • OCR was not available in the environment, so the solve relies on visual inspection, image crops, and OSINT.

Final Answers

Postal code:

29760

Flag:

{Yves-Marie_Gourlaouen_15}

TryHackMe-prefixed variant, if the room requires it:

THM{Yves-Marie_Gourlaouen_15}

References

  • KBC Penmarc'h, La catastrophe du 23 mai 1925 a Penmarc'h: https://kbcpenmarch.franceserv.com/la-catastrophe-du-23-mai-1925-selon-la-presse-locale.html
  • French postal barcode: https://fr.wikipedia.org/wiki/Code-barres_postal_fran%C3%A7ais
  • La Poste Penmarch: https://localiser.laposte.fr/finistere/penmarch/penmarch-291580
  • Cross-check writeup: https://dev.to/w1hi4/tryhackme-writeup-the-letter-full-osint-walkthrough-1bhc