Sleuthkit Intro picoCTF 2022 Solution

Description

1. Step 1Use Sleuth Kit's mmls

   Observation

   The challenge gives a disk image and asks for the Linux partition size in sectors. mmls reads the partition table directly and reports each partition's start, end, and length in exactly those units.

   mmls prints a partition map showing the start/length of each slice. The challenge specifically asks for the Linux partition length.

   What didn't work first

   Tried: Running fdisk -l disk.img instead of mmls disk.img to read the partition table.

   fdisk does show partition information, but in a different format: sizes in bytes or MiB rather than raw sectors, sometimes needing sudo or extra flags. The checker wants the raw sector count exactly as mmls reports it, so fdisk risks submitting a converted or rounded number that will not match.

   Tried: Submitting the Start sector value instead of the Length (size in sectors) of the Linux partition.

   mmls prints its columns in the order Slot, Start, End, Length, Description, so the number you want is the fourth one, not the first numeric one your eye lands on. The checker wants the partition's size, its length in sectors, not where it begins on disk.

   Learn more

   The Sleuth Kit (TSK) is a collection of open-source command-line tools for forensic analysis of disk images and filesystems. The name prefix mm stands for "media management" - these tools operate at the partition layer, below the filesystem. mmls reads the partition table and lists each partition with its start sector, end sector, and length.

   A partition table (MBR or GPT) lives at the very start of a disk and describes how storage is divided. Each partition entry records the starting sector, size in sectors, and partition type. Common Linux partition types: 0x83 (Linux filesystem), 0x82 (Linux swap), 0x8e (Linux LVM). Sectors are typically 512 bytes each on traditional drives.

   Understanding partition layout is foundational for disk forensics: to mount a specific partition from an image, you need its byte offset (start_sector × 512). For example: sudo mount -o loop,offset=1048576 disk.img /mnt/part. The mmls output provides exactly the information needed to calculate this offset.

2. Step 2Report the size

   Observation

   The setup says to connect to a netcat checker after running mmls. Once the Linux partition's length in sectors is read off that output, submitting the exact number is all that remains.

   Connect to the provided netcat service and enter the numeric length-if correct, it returns the flag.

   What didn't work first

   Tried: Entering the partition size in bytes (sectors multiplied by 512) instead of the raw sector count.

   The netcat service asks for the length in sectors as shown directly by mmls, not the byte-equivalent. Multiplying by 512 produces a much larger number that the checker will reject. Always submit the value in the same unit mmls displays - sectors.

   Tried: Submitting the size of the wrong partition - for example, the DOS partition or unallocated space instead of the Linux partition.

   mmls usually lists several rows: unallocated regions, a DOS partition table descriptor, and the Linux partition itself. The Description column identifies which is which, labelling the Linux one by name or by type code 0x83. Submit the size of an unallocated block or a metadata entry and it is rejected.

   Learn more

   This challenge pattern - where you must submit a forensic finding to a remote verification service - simulates the evidence-gathering workflow in real investigations. You analyze an artifact (disk image), extract a specific piece of information (partition size), and report it accurately.

   Partition sizes are measured in sectors (logical blocks, typically 512 bytes). The total size in bytes is length_sectors × sector_size. Modern drives use 4096-byte physical sectors (4K sectors or "Advanced Format"), but still present 512-byte logical sectors for compatibility - this distinction is important for alignment calculations in forensic mounting.

   The Sleuth Kit tool family includes: mmls (partition listing), fsstat (filesystem statistics), fls (file listing including deleted files), icat (extract file by inode number), and blkcat (read raw blocks). Together they provide complete filesystem analysis without needing to mount the image, which is important when preserving evidence integrity.

Flag

Getting comfortable with Sleuth Kit tools is foundational for disk forensics challenges.