DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

PicoCTF Sleuthkit Apprentice Writeup — Recover a File from a Disk Image

#ctf #security #forensics

A disk image (.img) is provided. With mmls we locate the partition table and the starting offset, then fls lists the files in the file system (including deleted ones), and icat lets us extract a file's content via its inode number — revealing the hidden flag.

  • Platform: picoGym
  • Category: Forensics
  • Points: 200 pts
  • Difficulty: Intermediate
  • Tools: mmlsflsicatThe Sleuth Kit

Challenge description

The challenge provides a single file, disk.img, with no other indication about its contents:

"We've got a suspect's disk image, but they've tried to hide something. Can you find it?"

A disk image is a raw (bit-for-bit) copy of a storage device — USB drive, hard disk, SD card. It contains a partition table and one or more file systems, exactly like a real disk. To explore it without mounting it, we use the The Sleuth Kit (TSK) tool suite, the reference toolkit for digital forensic investigation.

Step 1 — Read the partition table with mmls

The first step when facing any disk image is figuring out how it's structured: how many partitions it contains and at what offset (in sectors) each one starts. That's the job of mmls (media management list):

$ mmls disk.img

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

     Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000    0000002048   0000206847   0000204800   Linux (0x83)
003:  -------   0000206848   0000206847   0000000000   Unallocated
Enter fullscreen mode Exit fullscreen mode

We spot a single Linux partition (type 0x83), starting at sector 2048. This offset is what needs to be passed to every following tool.

Step 2 — List the files with fls

fls (file listing) lists every file and directory in a file system, including those that have been deleted but whose metadata is still present on the disk:

$ fls -o 2048 disk.img

d/d 11:      lost+found
r/r 12:      notes.txt
r/r 13:      vacation_photo.jpg
r/r * 15:     secret.txt
d/d 16:      Documents
Enter fullscreen mode Exit fullscreen mode

The -o 2048 option tells fls the offset (in sectors) where the partition found with mmls starts. Each line shows an entry type (r for regular file, d for directory), the inode number, and the file name.

The asterisk * next to inode 15 (secret.txt) is the crucial detail: it means this file has been deleted — its entry in the file system table has been marked as free, but its physical content probably hasn't been overwritten on disk yet.

Step 3 — Spot the suspicious file

On such a small disk, two things immediately stand out: the name secret.txt is explicit, and the fact that it's marked as deleted (*) suggests someone tried to cover their tracks after writing something to it. This is exactly the kind of anomaly a forensic investigator looks to recover.

We note its inode number: 15. This reference is what will let us extract its content directly, without going through the file path (which, technically, no longer exists in the table).

Step 4 — Extract the content with icat

icat (inode cat) displays a file's content from its inode number, reading directly from the associated data blocks — whether or not the file is still referenced in a directory:

$ icat -o 2048 disk.img 15
picoCTF{***}
Enter fullscreen mode Exit fullscreen mode

The deleted file's content shows up directly in the terminal — the flag had remained physically present on the disk, despite the logical deletion of its entry.

Summary of the full tool chain used:

# 1. Partition table -> find the offset
$ mmls disk.img

# 2. List files (including deleted ones) at that offset
$ fls -o 2048 disk.img

# 3. Extract the suspicious file's content via its inode
$ icat -o 2048 disk.img 15
Enter fullscreen mode Exit fullscreen mode

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

This challenge is an excellent introduction to the basics of disk forensics:

  • Deleting a file usually doesn't physically erase it from disk — only its entry in the file system table is marked as free
  • As long as the space occupied by the file hasn't been overwritten by new data, tools like The Sleuth Kit can find it and recover it via its inode number
  • The mmls → fls → icat chain is the go-to reflex for exploring any raw disk image without having to mount it

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)