TryHackMe: Missing Person Challenge Walkthrough

Introduction:

Welcome to my weekly walkthrough! If you’ve stumbled across this blog while looking for a detailed guide to the Missing Person blue team challenge from TryHackMe, you’re in the right place.

In this challenge, we’re jumping into the world of open-source intelligence (OSINT) and are tasked with helping locate a missing traveler who hasn’t returned from holiday. The challenge begins with just two images shared by our missing friend. From there, we’ll follow a trail of breadcrumbs through reverse image searches, event information, image metadata, social media profiles, and location-based clues to determine where he traveled and who he may have met along the way.

As we work through the investigation, we’ll rely heavily on Google for reverse image searching and discovery, while using ExifTool Online to examine image metadata and recover timestamps that help build our timeline. We’ll also pivot through publicly available information on Instagram, Facebook, and Google Maps to correlate identities, locations, and business details.

Along the way, we’ll race identify a MotoGP venue, establish a travel timeline, dig up social media connections, correlate usernames across multiple platforms, and follow a series of open-source clues that ultimately help us complete the police report.

In the spirit of learning some essential OSINT skills, this walkthrough will be spoiler-free to help help nudge you along without just giving you the answers.

Sounds like fun, right? Let’s go!

Thanks for reading and going on this investigation with me!

This write-up is for educational purposes only. All intellectual property related to the challenge belongs to the respective owners TryHackMe.

Challenge Scenario:

My friend went on holiday in 2025 and shared some photos, but I haven’t heard from him since. Can you help me track him down for the police report?

Question 1: What is the commercial name of this circuit?

Let’s get moving and see what we can do to help find our friend using the photos he sent.

First, extract the archive osint-1767765507985.zip, which leaves us with two image artifacts: food.jpg and MotoGP.jpg.

Overview of the challenge artifacts

The first task in our rescue missions is to identify the location of the holiday, specifically the commercial name of the MotoGP racing circuit he visited.

Google: using Google image search to identify the name of the racing circuit

Right away, Google returns an AI Overview with citations, along with several visual matches and related news articles that reference the specific circuit in Indonesia that we can cross-reference.

From an OSINT perspective, this is a good reminder that super recognizable locations like sporting venues and tourist attractions can often be identified with just a reverse image search.

Question 2: When did the event take place?

Now that we’ve identified the venue and the country, we have a little more to work with. Let’s narrow down the specific dates of his travel. For now, all we know is that the holiday took place sometime in 2025.

To figure out the specific dates, we’ll stick with Google and search for the name of the circuit we just identified along with the year: Pertamina Circuit 2025

Among the results, we’ll find a page on MotoGP that details the 2025 event schedule, including the dates of the race weekend.

MotoGP: Identifying the dates of the 2025 event

This is a high-fidelity source that gives us exactly what we need to determine the likely time frame of our friend’s travel. Since the photo was taken at a MotoGP event, the official race calendar provides strong evidence for when he may have been at the circuit.

Question 3: He told me he ate delicious Mexican food. What is the name of the restaurant?

No holiday is complete without some photo-worthy food. To start filling in the timeline of the holiday, we need to determine where he ate the delicious Mexican food shown in the second artifact, food.jpg.

For this, we’ll return to Google and perform another reverse image search. Since we already know the holiday took place in Indonesia, we can add Indonesia to our search to help narrow the results.

Google: Identifying the restaurant through a reverse image search

From the results, we’ll find several visually similar restaurants, along with a few other challenge write-ups, that point us toward the restaurant’s name.

This is a nice example of how previously collected information can help refine future searches. By combining reverse image search results with the geographic context we’ve already established, we’re able to significantly reduce the number of plausible locations and identify the restaurant.

Question 4: At what time was this photo taken?

Next up, we’ll continue to tighten our focus on our friend’s timeline. To answer Question 4, we need to determine the exact time the restaurant photo was taken.

To do this, we’ll need to examine the image metadata, which can contain all sorts of useful information about a photo, including the original timestamp. There are plenty of tools you can use locally, such as ExifTool, but a simple OS-agnostic approach is to use a browser-based utility like ExifTool Online. This tool allows us to upload the image and review its metadata directly from a web browser.

Once the image is uploaded, navigate through the results and look for the DateTimeOriginal field under the Raw ExifTool Output section.

ExifTool Online: Identifying the timestamp in the image metadata

The DateTimeOriginal value records when the image was originally captured by the camera device, giving us a precise timestamp that helps correlate our friend’s travel timeline with the other evidence we’ve collected so far.

Question 5: He sent me a message, this is the last I heard from him: ”Went to this cool MotoGP after party, and became friends with one of the local DJs who played that night. We’re going to visit a cave tomorrow.” What is the full address of the bar’s location?

Now we need to start using some context clues to identify an after-party our missing friend attended. Since we don’t have any photos to work with this time, we’ll need to piece things together using what we already know: the event, the country, and the dates.

Let’s start by returning to Google and searching for a phrase that combines those data points:

Pertamina Mandalika International Street Circuit MotoGP 2025 after party

We’ll comb through the image results and event listings, where we’ll find two major candidates:

Google: Identifying MotoGP after-party events

Both events seem associated with the race weekend, so we’ll need to investigate each one further. Checking out the GP Vol. 3 Instagram, we’ll figure out quickly that the address listed doesn’t match the format that we’re looking for.

Next, let’s investigate the second lead. The event information points us to a venue called Surfers Bar. Once we have the name of the venue, we can pivot to Google Maps and search for it directly.

This one gives us exactly what we’re looking for! The venue listing provides the full location details, including the address information needed to answer the question.

Question 6: What is the DJ’s stage name?

Now that we’ve identified the correct after-party, we need to figure out the name of the DJ who played at the event and invited our friend to an ominous-sounding cave visit.

We’ll stick with Google and continue searching for information related to the Surfers Bar afterparty. Before long, we’ll stumble across a Facebook post promoting the event with a short hype reel.

Facebook: Identifying the DJ with top billing at the event

The promotional video highlights several details about the event, including the performers appearing that night. We’ll find one DJ receiving top billing in the advertisement. This gives us another useful pivot point. If our friend’s message is accurate, the DJ may have local ties to the area and could provide a connection between the after-party and the cave visit mentioned in the message.

Question 7: After digging into the DJ’s other online accounts, what cave does he take tourists to?

So, we’ve uncovered the DJ’s stage name from the hype reel. Now we can pivot our investigation and start searching specifically for the DJ rather than the event.

A broad Google search for the DJ’s stage name quickly leads us to the DJ’s Instagram profile. While the profile itself doesn’t immediately answer the question, it does give us something valuable: a username that can be used for correlation across other platforms.

Armed with that username, we can perform a more targeted search: @<REDACTED>

This search returns an interesting result in addition to the Instagram profile we’ve already identified. Among the results is a Facebook page associated with a local cave that shares the same username.

Google search results identifying a Facebook page associated with the DJ’s username

While shared usernames aren’t 100% proof, they can be a strong OSINT indicator when combined with the other contextual evidence we’ve found. In this case, the shared username provides a connection between the DJ and a specific cave location, which aligns with the message our friend sent before disappearing.

Question 8: What number did the DJ list for his tour business?

We’ve made it to the final stop on our investigative tour.

At this point, we’ve successfully identified the cave associated with the DJ and can begin looking more closely at the cave’s social media presence. Conveniently for us, the page includes business contact information that can be viewed directly from the profile’s introduction and about sections.

With the phone number listed on the page, we have the final clue needed to complete the police report.

Conclusion:

That’s a wrap on Missing Person! How fun was that? A big thank you to TryHackMe for putting together another great challenge.

In this investigation, we started with nothing more than a pair of photographs and a handful of messages from our friend. From there, we used a combination of reverse image searching, image metadata analysis, social media research, and location-based investigation to reconstruct the details of his trip. This led us to identify a MotoGP venue, establish a travel timeline, track down a restaurant visit, pinpoint an after-party location, and find a local DJ with a cave tour side hustle. Not too shabby for just two pictures!

I picked this challenge because I’ve been wanting to spend more time developing my OSINT skills. While most of my investigations focus on endpoint telemetry, logs, or network traffic, open-source intelligence is a little less familiar. Rather than hunting through technical artifacts, we’re hunting through publicly available information and trying to connect the dots. That’s a skill that can be valuable not only in security investigations, but also in threat intelligence, incident response, and even everyday research.

The most interesting part for me was seeing just how effective a simple search engine can be. Time and time again throughout the challenge, we were able to pivot from a single clue to an entirely new lead. A photograph led us to a racing circuit. The circuit led us to an event. The event led us to a venue. The venue led us to a DJ. The DJ led us to a cave tour business. None of the individual clues seemed particularly significant on their own, but when combined, they painted a surprisingly detailed picture of someone’s activities.

Thanks for your support and partnering on this investigation. If you found this walkthrough helpful — please give it a clap and consider following me! Your feedback is invaluable, and it pumps me up to support your security journey. Remember, cybersecurity is a team sport, and we’re in this together!

Until next week’s challenge — stay curious and be safe out there!

Stumblesec