PicoCTF Writeup

DISKO 4 | PicoCTF Challenge Writeup

Part 4: Identifying and Extracting Hidden Artifacts using Disk Forensics

Description

Can you find the flag in this disk image? This time I deleted the file! Let see you get it now! Download the disk image here.

Objective: We have to retrieve the flag by analyzing the given disk image.

Hints:

• Hint 1: How will you search and extract files in a partition?

Walkthrough

First, I downloaded the given zip file — disko-4.dd.gz.

Then I unzipped the file using gunzip:

gunzip disko-4.dd.gz

The challenge description suggests looking for deleted files in the disk image.

Get Debmalya Mondal’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

So first, I checked the file system of the disk image using the following fls:

fls -r disko-4.dd

But as we need to search for the deleted files in the file system, we can easily identify a deleted file by looking for a specific file status indicator "+ r/r *". * means the file is deleted, and r/r means it was a regular file (not a directory).

fls -r disko-4.dd | grep '\+ r/r \*'

Here I found the file dont-delete.gz, which could be the file that we need to obtain our flag.

Then I use icat to extract the deleted file:

icat disko-4.dd 532021 > dont-delete.gz

Then unzipped the file using gunzip:

gunzip dont-delete.gz

I finally got the flag!

FLAG: picoCTF{***_****_****_****_********}

Quick Note

If you’re attempting this challenge, I highly recommend trying it on your own before reading the solution cause it really helps strengthen your skills.

Follow me for more cybersecurity and tech writeups.

Debmalya Mondal - Medium

Connect with me on 🔗LinkedIn.

If you found this write-up helpful, consider giving it a clap 👏. If you encounter any issues while solving the challenge or notice any mistakes in this write-up, feel free to let me know in the comments.