PicoCTF Writeup

DISKO 2 | PicoCTF Challenge Writeup

Part 2: Identifying and Extracting Hidden Artifacts using Disk Forensics

Category: Forensics

Difficulty: Medium

Description

Can you find the flag in this disk image? The right one is Linux! One wrong step and its all gone! Download the disk image here.

Objective

We have to retrieve the flag by analyzing the given disk image.

Hints

• Hint 1: How can you extract/isolate a partition?

Walkthrough

First, I downloaded the given zip file — disko-2.dd.gz.

Then I unzipped the file using gunzip:

gunzip disko-2.dd.gz

After unzipping it, I get the disko-2.dd disk image file.

Now, to extract human-readable text from the disk image, we can use the strings command.

To find the flag, I filtered the results for the typical text pattern of a picoCTF flag:

strings disko-2.dd | grep "picoCTF"

However, I find multiple flags, so I move on to the hints. The hint suggests extracting or isolating the partition.

Get Debmalya Mondal’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

So then I looked for partitions in the disk image using mmls:

mmls disko-2.dd

In the challenge description, it was mentioned that “the right one is Linux!” So I extracted the Linux partition using the following command:

dd if=disko-2.dd of=partition1.dd bs=512 skip=2048 count=51200

• dd – Copies raw data block‑by‑block
• if=disko-2.dd – Input disk image (source)
• of=partition1.dd – Output file (extracted partition)
• bs=2048 – Block size used for copying
• skip= – Number of blocks skipped at the start (where the partition begins)
• count= – Number of blocks copied (size of the partition)

After extracting the partition, I again use the strings command to retrieve the flag:

strings partition1.dd | grep "picoCTF"

This time, I finally got the flag!

FLAG: picoCTF{*_****_**_**_********}

Quick Note

If you’re attempting this challenge, I highly recommend trying it on your own before reading the solution cause it really helps strengthen your skills.

Follow me for more cybersecurity and tech writeups.

Debmalya Mondal - Medium

Connect with me on 🔗LinkedIn.

If you found this write-up helpful, consider giving it a clap 👏. If you encounter any issues while solving the challenge or notice any mistakes in this write-up, feel free to let me know in the comments.