Post

Disk,disk,sleuth2

All we know is the file with the flag is named down-at-the-bottom.txt...

image-1646

Download and extract the file.

image-1647

Use mmls to check the partition start offsets.

Then use fls to find down-at-the-bottom.txt.

image-1649

After finding the file, use icat to extract its contents.

fls lists filenames and their metadata addresses; icat uses the selected address to read the file. Supply the partition start sector with -o so the tools inspect the correct filesystem. See the icat manual.

image-1650

Here is the flag!

picoCTF{f0r3ns1c4t0r_n0v1c3_4bd721f2}


This post is licensed under CC BY 4.0 by the author.