← Back to HWJ CTF

THE HUNT (PART 4)

Inspect FAT32 filesystem inside USB disk image and recover deleted flag.txt file.

Tools Used

mmlsflsicatThe Sleuth KitAutopsy

Overview

ZIP archive contains FAT32 USB disk image. Investigate deleted files on removable media.

Reconnaissance

Run fls -r disk.img to locate deleted entry flag.txt inode.

Exploitation Strategy

Recover file using icat disk.img <inode>.

Solution Code

unzip "chall (2).zip"
fls -r disk.img
icat disk.img <inode_number>
# Output: hwj{st0r4g3_f0r3ns1c35_w45_34sy_2399}

Flag

hwj{st0r4g3_f0r3ns1c35_w45_34sy_2399}