If it is a : Run volatility -f [filename] imageinfo to determine the operating system profile.
: Write-ups for these challenges usually require identifying a specific "flag" or answering questions such as: What was the IP address of the attacker? What command did the user run at 10:45 PM? fa4150.part2.rar
If it is a : Mount it in Autopsy and look for "Low Hanging Fruit" like the RECYCLER bin or recent downloads. If it is a : Run volatility -f