Description
A full disk image hides the flag in a text file inside /root/. Use Sleuth Kit command-line tools (mmls, fls, icat) to find the file by inode and extract its contents.
Decompress the image and use mmls disk.flag.img to find the largest partition's start sector.
Run fls -r -o <offset> disk.flag.img to list all files recursively, then grep for flag to find the relevant inode.
Use icat -o <offset> disk.flag.img <inode> to extract the file and read the flag.
gunzip disk.flag.img.gzmmls disk.flag.imgfls -r -o <OFFSET> disk.flag.img | grep flagicat -o <OFFSET> disk.flag.img <INODE>Solution
Walk me through it- Step 1Find the flag file with Sleuth KitRun
mmls disk.flag.imgto find the largest partition's start sector. Use that as the offset forfls -r -o <offset> disk.flag.imgto list all files. Search the output forflagto find the inode numbers of the interesting files.bashmmls disk.flag.imgbashfls -r -o <OFFSET> disk.flag.img | grep flagLearn more
The Sleuth Kit is a collection of open-source command-line tools for forensic analysis.
mmlsreads the partition table,flslists filesystem entries (including deleted files), andicatextracts a file by its inode. All three are preinstalled on the picoCTF web shell.A disk image is a sector-by-sector copy of a storage device. It captures not just the visible files but also filesystem metadata, slack space, and deleted file remnants. Working with an image rather than the live device preserves evidence integrity and allows repeated analysis.
The
flsoutput may show two entries for the flag - one could be a deleted version. Try both inode numbers withicatto see which one contains the flag text. - Step 2Extract the flag file with icatRun
icat -o <offset> disk.flag.img <inode>to extract the file. The output contains the flag directly. If the file appears garbled, it may be UTF-16 encoded - try the other inode first, or pipe throughstrings.bashicat -o <OFFSET> disk.flag.img <INODE>bashicat -o <OFFSET> disk.flag.img <INODE> | stringsLearn more
icat(inode cat) extracts the data blocks of a file given its inode number, writing the raw bytes to stdout. This works even on deleted files whose directory entries have been removed, as long as the data blocks haven't been overwritten. The-oflag specifies the partition offset in sectors as returned bymmls.If the file is encoded as UTF-16 (two bytes per character), the raw output will look like every character has a null byte between it. Piping through
stringsfilters out non-printable bytes and shows the readable flag text.
Flag
picoCTF{by73_5urf3r_3497...}
Even without Autopsy, you could mount the image read-only and inspect the same path via standard Linux utilities.