Disk,disk,sleuth2
All we know is the file with the flag is named down-at-the-bottom.txt...
Download and extract the file.
Use mmls to check the partition start offsets.
Then use fls to find down-at-the-bottom.txt.
After finding the file, use icat to extract its contents.
fls lists filenames and their metadata addresses; icat uses the selected address to read the file. Supply the partition start sector with -o so the tools inspect the correct filesystem. See the icat manual.
Here is the flag!
picoCTF{f0r3ns1c4t0r_n0v1c3_4bd721f2}
This post is licensed under CC BY 4.0 by the author.



