DISKO 1 picoGym Exclusive Solution

Description

1. Step 1Decompress and identify the disk image

   Observation

   The download is a gzip-compressed raw disk image. Decompress it before any forensic tool can read the sectors.

   Run gunzip disko-1.dd.gz to produce the raw .dd image. Running file disko-1.dd reports a DOS/MBR boot sector with a FAT32 filesystem - a straightforward layout with no hidden partitions.

   bash

   gunzip disko-1.dd.gz

   Copied!

   bash

   file disko-1.dd

   Copied!

   Expected output

   disko-1.dd: DOS/MBR boot sector; partition 1 : ID=0xb, start-CHS (0x0,1,1), end-CHS (0x3ff,63,32), startsector 2048, 204800 sectors, extended partition table (last)

   What didn't work first

   Tried: Trying to mount the image directly with mount disko-1.dd /mnt to browse files before decompressing

   While it is still compressed, mount sees a gzip stream where it expects a FAT32 partition table and reports a wrong filesystem type. Decompress first to expose the sectors every disk tool wants.

   Tried: Using fdisk -l disko-1.dd.gz to inspect partition layout before gunzip

   fdisk reads the bytes and hits the gzip magic where the MBR signature should be, so it reports a size mismatch or no valid partition table. Decompress first, then identify the real image.

   Learn more

   Disk images are bit-for-bit copies of storage media stored as regular files. The .dd format is a raw binary dump produced by the dd utility (or forensic equivalents like dcfldd). Compressing disk images with gzip is standard practice because raw images often contain large regions of zero bytes that compress dramatically. The gunzip command decompresses in place, replacing the .gz archive with the original file.

   The file command identifies file formats by reading magic bytes - a fixed byte signature at the start of the file that identifies its type, independent of the filename extension. For disk images, file reports the partition table type (MBR or GPT) and the filesystem of the first partition. Knowing the filesystem type (FAT32, ext4, NTFS, etc.) tells you which forensic tools can parse it and what kind of metadata structures to expect.

2. Step 2Search for the flag with strings

   Observation

   The description says the flag sits as a plain string inside the FAT32 filesystem, so strings piped through a case-insensitive grep finds it in the raw image with nothing mounted.

   Run strings on the raw disk image and pipe through grep -i pico. The flag is stored as a plain ASCII string directly inside the filesystem and is visible immediately - no mounting or filesystem tools needed.

   bash

   strings disko-1.dd | grep -i pico

   Copied!

   What didn't work first

   Tried: Running strings disko-1.dd | grep picoCTF (case-sensitive, no -i flag)

   If the flag sits in a metadata field or a directory entry, FAT32 may have altered its casing, and a case-sensitive grep then drops it silently. The description promises a plain string; it does not promise the case survived.

   Tried: Mounting the image and using find /mnt -type f -exec grep -r pico {} ; to locate the flag as a file

   That assumes the flag lives inside a named file, and here it is written into the image as raw bytes, possibly in a data area, in slack space, or in metadata, none of which a normal mount necessarily exposes. strings finds any printable sequence anywhere in the image, faster and without root.

   Learn more

   The strings command scans a binary file for sequences of printable ASCII characters of a minimum length (default 4). It works directly on raw disk images without mounting, making it a fast first-pass tool in forensics. Any file content, filesystem metadata, directory entries, or deleted fragments that contain readable text appear in the output.

   In a real forensic investigation, strings alone is insufficient because it provides no context about which file contained the text or its location on disk. For deeper analysis, The Sleuth Kit tools - fls to list files by inode, icat to extract a file by inode number, and fsstat for filesystem statistics - give complete visibility into the file structure. For DISKO 1, the flag is embedded as a plain string with no obfuscation, so strings | grep is all that is needed.

   The -i flag to grep makes the search case-insensitive. Always use it when searching for pico because some challenges embed flags in all-caps metadata or filenames that picoCTF alone would miss.

Flag

The flag lives as a plain string in the FAT32 image. `strings disko-1.dd | grep -i pico` finds it on the first try.