PicoCTF Sleuthkit Apprentice Writeup — Recover a File from a Disk Image

A disk image (.img) is provided. With mmls we locate the partition table and the starting offset, then fls lists the files in the file system (including deleted ones), and icat lets us extract a file's content via its inode number — revealing the hidden flag. Platform: picoGym Category: Forensics Points: 200 pts Difficulty: Intermediate Tools:... Weiterlesen: PicoCTF Sleuthkit Apprentice Writeup — Recover a File from a Disk Image