DiskFiltration — Write-Up (TryHackMe)

DiskFiltration CTF on TryHackMe.com

Tech discovered their critical data had been leaked to the competitors. After an internal investigation, the company suspects Liam, a recently terminated employee who was working as a system engineer with Tech. This suspicion was raised as Liam had access to the leaked data in his company-provided workstation. He often worked late hours without clear justification for his extended presence. He was also caught roaming around the critical server room and taking pictures of the entry gate. Following these suspicions, Liam’s workstation (provided by the company) was investigated. The initial investigation suggests that an external entity was also helping Liam.

Let’s use the knowledge we gained from the previous modules of this path to search for traces of Liam’s activities.

Flag 1 — USB Device Serial Number

First, launch the VM and Autopsy to analyze the file located in “Disk For Analysis” on the Desktop. We create a new case → “Add Data Source” and select the file we want to analyze, in our case dis.E01. The process takes a while so be patient. Once done, in Data Artifacts > USB Device Attached, you will find our USB device serial number (265193109799349666) linked to Device Model VID_346D&PID_5678. Got the first flag!

FLAG: 2651931097993496666

Flag 2 — Hotspot Name

We are looking for the hotspot used by Liam to evade network security. We dig into the registry (Data Artifacts > Installed Programs > Connection Manager in the list) and click on the “Application” tab:

ROOT > Microsoft > Windows NT > NetworkList > Profiles

We get the second flag once we read the registry values.

Navigate through “Installed Programs” in “Data Artifacts” to find “Connection Manager”

Then we find the hotspot name in the “Profiles” registry folder

FLAG: Liam’s Iphone

Flag 3 — Suspicious Archive

It’s been two flags in a row; the third is also quite simple to find when filtering file types by extension, as shown in the screenshot below.

The archive file we are looking for

FLAG: Shadow_Plan.zip

Flag 4 — Archive Password

The fourth flag consists of the password used to uncompress the zip archive Shadow_plan.zip, which can be found by filtering by Documents > Plain Text. You can also click the "Location" tab in the listing to narrow it down faster. There is a file called Pass.txt containing the password we are looking for.

A text file containing the password needed for the archive

FLAG: Qwerty@123

Flag 5 — PDF Author

We enter the password obtained from Flag 4 and open the attached PDF file breach_plan.pdf with any PDF reader. The author's name is revealed by looking at the file properties:

We can find the author name by looking at the properties

FLAG: Henry

Flag 6 — True File Extension

The 6th flag can be obtained by identifying the real file extension of the confidential file inside the archive. Since it has no visible extension, we open it in a hex editor (e.g. HxD) and inspect the magic bytes/file header to determine the actual format.

We can find the PNG extension when we open “confidential” with HxD

FLAG: PNG

Flag 7 — WordWheelQuery (Search History)

The 7th flag is found by examining the registry inside the NTUSER.DAT file located at C:\Users\Administrator. In Autopsy, click on NTUSER.DAT, then open the "Application" tab in the registry viewer and navigate to:

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Get Imagohostpro’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This key stores the user’s Windows Explorer search bar history, revealing what Liam was looking for on the workstation.

The first file Liam searched for

And the second one

FLAG: Financial, Revenue

Flag 8 — Files Accessed on USB

The 8th flag is also found in the NTUSER.DAT registry. By examining the relevant registry keys (e.g. RecentDocs or USB-related entries), we can identify which files were accessed or transferred via the USB device.

We can see the files “Exfiltration Plan” and “Critical Data TECH THM”

FLAG: Critical Data TECH THM, Exfiltration Plan

Flag 9 — Prefetch / Execution History

The 9th flag consists of finding when file_uploader.exe was last executed and how many times it ran. Navigate to Data Artifacts > Run Programs (Prefetch data) to find this information.

“file_uploader.exe” has been executed twice

FLAG: 2025–01–29 11:26:09, 2

Flag 10 — Alternate Data Streams (ADS)

The 10th flag is obtained by inspecting the ADS (Alternate Data Streams) attached to the confidential file in the uncompressed zip archive directory. ADS is an NTFS feature that allows additional data to be associated with a file without altering its visible content — a classic data-hiding technique.

You can reveal ADS using:

Get-Item * -Stream *

Or via tools like Autopsy or streams.exe from Sysinternals.

Listing Alternate Data Streams

Reading into an ADS to find the flag

FLAG: FLAGT{THM_TECH_DATA}

Flag 11 — Deletion Timestamp via USN Journal

The 11th flag requires finding the deletion timestamp of a file that was erased from the filesystem. Autopsy alone is not sufficient here, so we use MFTECmd.exe (by Eric Zimmerman) to parse the $UsnJrnl:$J (Update Sequence Number Journal) into a CSV file.

Steps:

1. Export the $UsnJrnl:$J artifact from the disk image (you can extract it via Autopsy or FTK Imager).
2. Run MFTECmd.exe to parse it:

MFTECmd.exe -f "$UsnJrnl_$J" --csv . --csvf usnjrnl_output.csv

1. Open the resulting CSV in Timeline Explorer or Excel and filter for the target filename (or Ctrl+F with Notepad to search for “Tax Records.docx”).
2. Look for entries with the reason flag FILE_DELETE / CLOSE — the associated timestamp is the deletion time and our flag.

FLAG: 2025–01–29 11:29:02

Flag 12 — Web Browser History

Flag 12 is straightforward: navigate to Data Artifacts > Web History. There is only one social media link in the list, which gives us the answer.

FLAG: https://www.faceb**k.com/

Flag 13 — History of PowerShell Commands

The last and final flag is obtained by browsing the filesystem to:

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine

The ConsoleHost_history.txt file in this directory logs every command typed in PowerShell, revealing the last piece of evidence.

Final flag is found here

FLAG: Get-WmiObject -Class Win32_Share | Select-Object Name, Path

All 13 flags collected — CTF complete! Thanks for reading, feel free to follow if you enjoyed the writeup.