Part 0: Case Files and starting content.

Case File

CASE FILE: THE DISAPPEARANCE OF OWAIN HUGHES
Client: The Hughes family, North Wales
Missing person: Owain Hughes, 19 (DOB: 19/05/2006)
Last known location: Llandudno, North Wales
Suspected destination: South Wales
Background
Owain Hughes, 19, left home in Llandudno abruptly. There was no argument, no
long goodbye, and no clear plan shared with family. Within 48 hours, Owain’s
phone went mostly silent. The family received one short message, but it felt wrong
and unlike him.
Over recent months, Owain had been talking to a girlfriend based in South Wales.
The relationship wasn’t a secret, but it was oddly private, he stopped mentioning
mutual friends, became harder to pin down, and began keeping his phone face
down and close. He also withdrew from people he normally relied on.
The family does not want to assume the worst. They understand a young adult can
move out, fall in love, and start fresh. But the speed of the change, the sudden
distance, and the way he has cut off contact has left them worried.
Concerns
The family’s concerns are framed as patterns rather than accusations. They describe
Owain as increasingly isolated. He stopped turning up to regular plans. He stopped
replying to certain people. His routines changed overnight. There are also small
signs that he may have been pulled into a new social circle that encourages poor
decisions and “shortcuts”, things that look exciting at first and become difficult to
step away from once you are in.
At this stage, there is no confirmed criminality, no confirmed harm, and no
confirmed coercion. But the combination of silence, sudden relocation, and
isolation is enough for the family to hire an investigator to establish facts, not
assumptions.
Objectives
Using open-source intelligence, you must determine:
• Where Owain is likely staying
• Whether he appears safe and acting freely
• Whether there are signs he needs support or safeguarding
• What the family should do next, based on the evidence
Rules of Engagement
This is an OSINT only investigation:
• No direct contact (All characters are fictional for this CTF)
• No harassment
• No hacking into accounts
• No doxxing
• No private data access
Everything must be derived from public information, public posts, and the clues
provided in the challenge materials

Case File Images

Part 1: The First Lead

The Hughes family is deeply concerned. Their 19-year-old son, Owain, has abruptly left their home in Llandudno. While he had been mentioning a girlfriend in South Wales, his sudden silence and isolation have left his parents worried about his well-being.

As a Private Investigator, your first task is to review the initial evidence. We need to confirm the core facts from the family's briefing and the recovered photos before we begin tracking his journey south.

**Your Task:** Review the attached PDF and images to confirm the missing individual's full name, year of birth, and the city where he usually lives.

All related info was found in the case file.

Part 2: A Bitter Sweet Memory

The Hughes family has provided a collection of photos recovered from Owain's room, several of which depict a life they don't recognise.

They were particularly confused by an image of Owain posing with a dog, noting that he has never been allowed to own pets. However, the most pressing lead comes from a different photograph, a printed picture with a specific date and a handwritten note scrawled across the front.

The message simply reads: "Our favourite spot... why did Kelly have to go?"

The family has no idea who or what "Kelly" refers to. To understand Owain's movements and state of mind before he headed south, you need to find out exactly what happened at the location in this specific photo on that date.

**Your Task:** Identify the name of the entity Owain is referring to in his note.

Step 1: Geolocating the photograph

The printed photo showed a coin-operated telescope on a pier with distinctive teal/turquoise railings and a hillside town visible across the water in the background.

I first searched the image using Google Lens but got no direct results. I then added the keyword “Wales” to the search, which led me to Llandudno Promenade, North Wales. I confirmed the exact location using Google Earth, matching the railing design, telescope position, and the Great Orme headland visible in the background.

Step 2: Noting the date

The handwritten note on the photo included the date 07/12/2024 (7th December 2024), giving a specific timeframe to investigate alongside the location.

Step 3: Researching the Location on That Date

Searching for significant events at Llandudno Pier on 7th December 2024 returned multiple news articles about Storm Darragh, which struck North Wales that exact day with winds reaching up to 93mph, causing catastrophic damage to the pier.

Step 4: Identifying “Kelly”

News sources including the North Wales Pioneer reported that the storm had destroyed Kelly’s Ice Cream parlour on the pier:

“The Kelly’s Ice Cream parlour on the pier was reported to have ‘completely gone,’ while a 150-year-old unit was ‘ripped off its foundations’.” — North Wales Pioneer

This matched perfectly with the emotional tone of Owain’s note — Kelly’s was a beloved fixture at his favourite spot, swept away by the storm on that exact date.

Part 3: The Drone Footage

Since the family suspect that Owain has headed south, it has jogged their memory. They remembered a video he sent via WhatsApp during a previous visit to his girlfriend. Owain is a bit of a drone enthusiast; when his parents asked where he was, he simply sent back some aerial footage of the coast without actually naming the location.

The family have provided the video file in case it is relevant to his current whereabouts. They hope you can pinpoint the settlement where this was filmed to give us a starting point in the south.

**Your Task:** Identify the name of the village or settlement nearest to where this drone footage was taken.

Step 1: Extracting a Frame from the Footage

A frame was taken from the drone footage showing an aerial view of a coastal area featuring a parking area, sandy beach, rocky shoreline, and an estuary.

Step 2: Reverse Image Search

The frame was searched using Google Lens, which identified the location as Ogmore-by-Sea, Bridgend, Wales. Google’s AI overview confirmed key features visible in the footage including the Ogmore Estuary, the clifftop village, and the rocky beach all consistent with the aerial shot.

Part 4: Static On The Line

A worried friend of Owain’s from North Wales has come forward. He received a brief WhatsApp audio message from Owain just before the trail went cold. Recognising the potential importance of the message, the friend forwarded it to the family, who have now passed it on to you.

The message itself is in Welsh. Owain sounds calm, telling his friend: "Dw i’n iawn, paid â phoeni. Bydda i’n cysylltu’n fuan" (I’m okay, don’t worry. I’ll be in touch soon).

While the spoken words don't appear to reveal much, it sounds like Owain sent this message as he was about to disembark from a train. We need to analyse the audio for any additional clues to determine exactly which station he might be at.

**Your Task:** Identify the specific train station Owain had arrived at when he sent this audio message.

Step 1: Attempting Audio Analysis

The audio was loaded into Audacity to try to isolate the background noise. Several online tools were also tested, however most were designed to remove background noise rather than amplify it, making them unsuitable for this task.

After multiple listens to the raw audio, a faint station announcement could be partially made out in the background. The audio was unclear but appeared to start with the letter “C”.

Step 2: Cross-Referencing Welsh Train Stations

Using the partial audio clue, AI was used to generate a list of the top 10 busiest train stations in Wales in Welsh. The first result beginning with “C” was Caerdydd Canolog (Cardiff Central) consistent with what could be heard in the background of the recording.

Given that Owain was already known to have headed south from North Wales, Cardiff Central was a logical and geographically consistent destination.

Part 5: The Vanished Mansion (Side Quest)

While investigating the area near the drone footage location of Ogmore-by-Sea, you may 
have stumbled upon the history of a grand estate that once dominated the nearby cliffs — 
Dunraven Castle. This massive Victorian mansion fell into ruin after the family faced 
staggering debts and death duties. Rather than sell, the structure was stripped and 
eventually dynamited in the mid-20th century. Today only the walled gardens and stone 
footprint remain.

At its peak in 1888, architects Williams, West and Slade published grand plans for 
additions to the house. Your task: locate the 1888 ground floor plan and identify the 
private room with a curved bay window in the North-West wing, situated next to a bedroom 
and dressing room.

Step 1: Identifying the Source

The first challenge was figuring out where the UK archives old architectural plans. The answer: major Victorian architectural journals like The Builder routinely published detailed plans and elevations of notable houses. A quick search of academic sources confirmed the Dunraven plan appeared in:

The Builder, Vol. 54, p. 379 (1888)

Step 2: Finding the Plan

Searching Google for:

"Williams, West and Slade" "Dunraven"

Returned a single result — an AbeBooks listing by Cosmo Books for an original page from The Builder, 1888, described as a double sheet print showing Dunraven Castle, Glamorganshire. Crucially, the listing included a photograph of the actual print — showing both the exterior elevation and the ground floor plan side by side.

Step 3: Reading the Plan

On the ground floor plan, navigating to the North-West wing revealed a cluster of private rooms: a Bedroom, a Dressing Room, and adjacent to both — a small room with a distinctive curved bay window protruding from the exterior wall.

The room was labelled on the floor plans.

Part 6: Digital Footprint

With Owain now tracked to Cardiff, we need to see what he’s been doing in the city. While he was quiet on his "official" social media with family, he likely maintained a more private presence to stay connected with his new social circle.

People often include personal identifiers when creating usernames to make them easier to remember. When searching for a specific individual, it's worth considering various combinations of their name and significant words or numbers. You will likely need to experiment with several formats to find the right profile.

**Your Task:** Locate Owain’s X account and provide both his username and his unique numeric User ID.

Step 1: Initial Search — Too Many Results

Searching “Owain Hughes” directly on X under the People filter returned approximately 50 accounts. Owain Hughes is a common Welsh name and none of the results could be confirmed as the correct individual. A direct name search alone was not going to work.

Step 2: Incorporating Personal Identifiers

Revisiting the case file revealed a key detail: DOB 19/05/2006. The challenge hinted that people often combine their name with significant numbers when creating usernames. His birth year 06 was the obvious candidate, pointing toward the username format owain_hughes06.

Step 3: Finding the Account

Remaining under the People filter on X was not surfacing the right result. Switching to Top Posts and searching the same name brought up a post that immediately stood out. The profile was examined and Owain was visually recognised from imagery gathered earlier in the investigation.

Step 4: Confirming Identity

Visual recognition alone wasn’t enough given how common the name is. Earlier in the investigation, a family photo from the Hughes family case file had revealed a distinctive chest tattoo on Owain. Cross-referencing this tattoo against photos visible on the X profile provided a solid secondary confirmation that this was the correct Owain Hughes and not a false positive.

Step 5: Extracting the Numeric User ID

With the account confirmed, the numeric User ID was extracted by locating a post on his profile and feeding the tweet URL into:

Tweet Hunter ID Converter

This tool converts a tweet’s status ID into the account owner’s unique numeric User ID.

• Username: owain_hughes06
• User ID: 2015498369553055744

Part 7: The Name Behind the Screen

While reviewing Owain’s public X posts, you notice something important, a personal detail that strongly suggests who he has been spending time with since arriving in Cardiff.

**Your Task:** Identify the name of Owain’s girlfriend.

Method: Reviewing Owain’s Posts

With his X account now confirmed as owain_hughes06, his public posts were reviewed directly on his profile. Owain had made one post that contained a direct personal reference:

“Running with Emina to clear our heads. Not sure if that did the opposite, though. Hoping things will clear up soon. :(“

The post names his girlfriend as Emina and also hints that the pair are going through a difficult or stressful situation — consistent with the family’s concerns about his circumstances in Cardiff.

Part 8: What’s Occurrin’? (Side Quest)

While reviewing Owain's X profile, something in his biography stands out. It doesn't 
look like a standard personal description — instead it reads more like a specific 
reference or quote lifted from popular culture.

Your Task: Identify the origin of the reference used in Owain's profile biography.

Bio: "and before you ask, no I don't!"

Method: AI-Assisted Cultural Reference Search

The phrase “and before you ask, no I don’t!” was searched using AI assistance to identify its origin in popular culture. The phrase was identified as a reference to the beloved British sitcom Gavin & Stacey.

Part 9: The Coded Twist

Following the latest developments in Cardiff, we have received a direct message from one of Owain’s close friends back home in North Wales. Owain had remained in occasional contact with this friend after leaving, but the messages became increasingly vague, as though he was worried someone else might see them.

To avoid the message falling into the wrong hands, the friend chose not to forward it to Owain’s parents directly. Instead, he contacted us privately, believing this information could explain why Owain ran, and why he is so determined to stay hidden.

The following transcript is taken from the message the friend sent to the investigator.

Message Transcript:

Hi, my name is Iestyn.  
Owain’s parents told me you’re helping them to find him.  
You must keep this to yourself, but Owain sent me a message.  
He coded it because no one else can find out about this.  
Find the right book and you’ll understand everything.

**4.6.1 / 12.14.2 / 16.53.3 / 19.14.1 / 21.3.3 / 32.2.1 / 7.7.3 / 14.9.1 / 19.20.6 / 26.4.1 / 34.6.4 / 50.1.1 / 40.29.3 / 29.1.2 / 39.24.6 / 44.19.4 / 28.19.1 / 41.1.2 / 50.35.4 / 55.35.1**

(The transcript and code will be given as a TXT file – IestynsMessage.txt)

**Your Task:** Decode the message sent by Iestyn.

welsh version https://www.ysgolglanrafon.co.uk/wp-content/uploads/2023/11/y-goli-o-nunlle.pdf

Cipher string: 4.6.1 / 12.14.2 / 16.53.3 / 19.14.1 / 21.3.3 / 32.2.1 / 7.7.3 / 14.9.1 / 19.20.6 / 26.4.1 / 34.6.4 / 50.1.1 / 40.29.3 / 29.1.2 / 39.24.6 / 44.19.4 / 28.19.1 / 41.1.2 / 50.35.4 / 55.35.1

Step 1 – Finding the Book

The challenge included an image of Owain’s room. Looking carefully at the mirror reflection in the image, a book spine was visible on a shelf. I took a screenshot and ran it through Google Lens, which identified it as The Goalie from Nowhere by Alan MacDonald a children’s football novel from the TreeTops series.

Given that this CTF is heavily Welsh-themed, I suspected the cipher wasn’t using the English version. A quick search turned up the Welsh language edition: Y Gôli o ‘Nunlle, published by Drake Educational Associates, Cardiff (2002). I found a PDF of this edition to work with.

Step 2 – Understanding the Cipher Format

The format page.word.letter — each code points to a specific page number, the nth word on that page, and the nth letter within that word.

So 4.6.1 = Page 4, Word 6, Letter 1.

Step 3 – Decoding

Using the Welsh PDF, I fed the codes to AI to systematically extract each letter. The full decode:

Decoded Message

family abuse me not safe

Significance

This completely reframes the investigation. Owain didn’t simply run away he fled an abusive home environment and has been deliberately hiding to protect himself. The message was encoded specifically so it couldn’t be read if it fell into the wrong hands, and sent only to his most trusted friend. It explains his vague contact with family, his reluctance to be found, and why he never spoke about his reasons openly.

Part 10: A Familiar Stop

**Investigator's Update:** The decoded message from Task #7 changes everything. We were hired to reunite a family, but the evidence now suggests that "home" may be the most dangerous place for Owain.

Ethically, we cannot provide his location to the clients (the parents) knowing this information. However, if we simply cease the investigation, they will likely hire another investigator, or worse, they may come looking themselves.

We must change our strategy. We need to find Owain before anyone else does, not to hand him over, but to warn him, ensure he has support, and verify his safety so we can close the case on our terms. We are pressing on, but our loyalty has shifted.

---

Owain has now resurfaced publicly through a shared running activity posted to his X account. The route appears to cover areas around Cardiff Central and through Bute Park, suggesting he is moving confidently around the city and is familiar with the area.

However, towards the end of the run, Owain appears to have stopped briefly at a specific shop before the activity ended.

**Your Task:** Identify the name of the location where Owain stopped near the end of his run.

Method

Using the map image posted to Owain’s X account, I traced the running route manually, following the path through Bute Park and into the Cardiff Central area.

Near the end of the route, the track appeared to stop briefly at a specific point before the activity ended. Cross-referencing that location on Google Maps, the area contained two nearby businesses a Greggs and a Tesco.

My first instinct was Greggs, reasoning he may have stopped for food. However, Greggs was not accepted. The correct answer was Tesco.

Part 11: Putting Together The Pieces

After Owain’s stop at Tesco, his running activity ends abruptly at the nearby bus station. The sudden change in route suggests something may have happened immediately after his visit.

To investigate further, we went to the area and spoke with local witnesses. One person reported seeing a young couple having a disagreement outside the Tesco. The witness described the young man as visibly frustrated. Moments later, he stormed off towards the bus station and tore up the paper he was holding.

With help from the witness, we had a look around the area where he threw the paper and were miraculously able to recover the torn-up pieces. It appears to be a receipt.

**Your Task:** Reconstruct the attached torn receipt and extract the following information:  
- The last 4 digits of the card used to pay  
- The Clubcard points balance

I referenced a standard Tesco receipt layout online to understand the typical field positions, then carefully examined the torn fragments, rotating and zooming the image to align the pieces and reconstruct the key details visually, no specialist software required.

Part 12: The Gatekeepers

Following the heated argument outside the station, the witness felt uneasy leaving the young woman alone. She decided to follow at a distance as the woman walked away from the Tesco and towards the entrance of a modern apartment building around the corner.

Seeing her fumble for her keys outside the entrance, the witness approached briefly to check she was okay. The woman brushed it off, muttering that she was fine and just wanted to get inside. As she held her keys up to the electronic fob reader, the witness caught a glimpse of a small plastic tag hanging from the keyring with the number 701.

We now have an apartment number, but we need a point of contact for the building itself. It is the block located opposite Black Sheep Coffee on Wood Street. To proceed, we need the details of the registered Managing Agent responsible for this property.


**Your Task:** Identify the Name and License Expiry Date of the agent connected to this building.

Method

I searched for Black Sheep Coffee on Google Maps and looked at the block directly opposite, which was named Wood Street House.

From there I focused on finding information about the building. Everything I needed turned out to be on the company’s own website. In the footer of the apartments page there was a link to their Rent Smart Wales Agent Licence PDF, which contained the agent name, licence number, and expiry date.

Woodstreethouse Woodstreethouse licence

Additional details confirmed along the way: the apartment is on the 7th floor, the building is called Wood Street House, and a 1-bed apartment costs £1,800/month (found via their Instagram reel).

Part 13: Hidden in Plain Sight

We now have a confirmed lead on the apartment building opposite Black Sheep Coffee, as well as the registered managing agent responsible for the property. With this information, we attempted to make contact and progress the investigation further.

Unfortunately, the managing agent refused to provide any details regarding tenants or occupants within the building, citing privacy and security reasons.

We then attempted to buzz the apartment directly. There was no answer.

At this stage, we cannot confirm whether Emina is currently inside the property, or whether she has left the area since the incident. With Owain’s whereabouts still unknown, making direct contact with her is now critical.

We need another way in. Is there any way we can identify her phone number?

**Your Task:** Look back through the evidence so far to see if there is anything we've missed that reveals a phone number.

Method

This one had me stumped for a while. I kept going back through all the evidence looking for anything that might contain a phone number social media bios, image metadata, the receipt. It wasn’t until I went back through every photo from the very beginning that I realised the opening image of Owain with a dog hadn’t actually been used in any previous task. Looking more closely at the photo, a number was visible on the dog’s collar tag which turned out to be Emina’s phone number.

Part 14: The Quiet Place

After progressing the investigation to the apartment building opposite Black Sheep Coffee, we attempted to make contact with Owain’s girlfriend. With no response at the door and no way to confirm whether she was inside, we reviewed the evidence again and located Emina’s phone number.

We managed to reach her directly and arranged to meet her back at her apartment later that day to discuss what had happened.

When we spoke, she appeared shaken and insisted she did not know where Owain went after the argument outside Tesco. According to her, Owain left the area immediately, heading into the bus station and disappearing from view. His whereabouts are currently unknown.

However, she did provide one crucial detail.

Emina explained that this is not the first time Owain has needed to be alone. On a previous occasion when he felt overwhelmed, he mentioned that there is a particular place he goes to unwind, somewhere quiet, away from people, where he can clear his head.

She said Owain had referenced this spot before as somewhere he goes when he needs space to think. In the past, Owain sent her an image of the location, but he never told her exactly where it was.

Emina has now forwarded that same photo to us, but she is unable to confirm where it was taken.

**Your Task:** Identify the location shown in the image so we can locate Owain and confirm his wellbeing.

Method

Emina forwarded us the image Owain had previously sent her of his quiet spot. I ran it through Google Lens, which identified it as the statue of David Davies outside the former Barry Dock Offices in Barry, Wales. David Davies was a prominent 19th-century Welsh industrialist instrumental in the development of Barry Docks. The statue overlooks the docks to the south, with residential buildings and a promenade nearby.

The End

Using the location identified in the final image, we attended the area immediately to confirm Owain’s wellbeing.

Owain was located nearby, alone, and did not attempt to flee when approached. He appeared exhausted but physically unharmed. After confirming our identity and explaining that we were acting on behalf of concerns raised by his family, Owain made it clear that he was not “missing” in the traditional sense.

Owain confirmed that he left North Wales intentionally and that he does not wish to return home at this time. He stated that his decision to cut contact was made for his own safety and peace of mind, and that he felt unable to live under the conditions he experienced at the family home. He also expressed concern that if his location was shared, his family would attempt to regain control over him and force him back.

As part of our duty of care, we confirmed that Owain was safe, had access to food, shelter, and support, and was in contact with at least one trusted person. Owain was informed that no further communication or location updates would be shared with his family, and that we would not disclose his whereabouts to any third party.

Owain agreed to provide a brief confirmation of safety, which was relayed back to the Hughes family in a neutral manner, confirming only that:

• Owain is alive and safe
• He is not currently missing or in immediate danger
• He does not wish for his location to be shared
• He will make contact on his own terms when ready

With Owain’s safety confirmed and his wishes respected, the investigation is now considered complete.

Case Status: Closed, safeguarding considerations noted, no further action required.