DISKO 2 picoGym Exclusive Solution

Description

1. Step 1Decompress and read the partition table

   Observation

   The image holds several partitions and the flag is in the Linux one, so read the partition table first and find where that partition starts.

   Run gunzip then fdisk -l disko-2.dd to display the partition table. The output shows at least two partitions. The Linux partition starts at sector 2048 and spans 51200 sectors (each sector is 512 bytes).

   bash

   gunzip disko-2.dd.gz

   Copied!

   bash

   fdisk -l disko-2.dd

   Copied!

   What didn't work first

   Tried: Run strings disko-2.dd | grep -i pico on the whole undecompressed image before reading the partition table.

   With several partitions in the image, strings mixes them all together and returns false positives from unrelated regions. Read the partition table first and isolate the one you want.

   Tried: Use file disko-2.dd to identify the disk layout instead of fdisk.

   file names the top-level format and stops there; it does not enumerate partitions or their start sectors. fdisk parses the whole table and prints each entry's start, size, and type code, which is exactly what the extraction needs.

   Learn more

   A partition table maps a physical disk into logical regions called partitions, each holding an independent filesystem. The traditional MBR (Master Boot Record) layout stores up to four primary partitions in a 64-byte table at the very start of the disk. Each entry records the starting LBA (Logical Block Address) sector, the size in sectors, and a type byte that identifies the filesystem type (0x83 = Linux ext, 0x0B/0x0C = FAT32, 0x82 = Linux swap).

   fdisk -l reads the partition table and displays each partition's start sector, end sector, size, and type. This is the essential first command when you receive any disk image with multiple partitions, because strings on the whole image would find text from all partitions mixed together - you need to isolate the right partition first.

   The sector size is almost always 512 bytes for images from CTF challenges. Multiplying the start sector by 512 gives you the byte offset to pass to dd's skip option. Multiplying the sector count by 512 gives you the byte size to pass to count.

2. Step 2Extract the Linux partition with dd

   Observation

   fdisk gives the start sector and the length, which are exactly the skip and count dd needs to carve it into a standalone file.

   Use dd to carve out just the Linux partition bytes into a new file. Skip the first 2048 sectors (the MBR and any preceding data) and copy 51200 sectors worth of data.

   bash

   dd if=disko-2.dd of=linux-part.dd bs=512 skip=2048 count=51200

   Copied!

   What didn't work first

   Tried: Use dd with skip=2048 but omit count=51200, copying to the end of the image instead.

   Without a count, dd copies from the start sector to the end of the image, sweeping in every partition after it. The result is oversized, confuses filesystem tools, and fills the strings output with irrelevant hits. Use the length fdisk reported.

   Tried: Use bs=1 with a byte-level skip offset calculated as 2048 times 512 equals 1048576, instead of bs=512 skip=2048.

   A block size of 1 is arithmetically equivalent and makes dd read and write a byte at a time, which crawls on a multi-megabyte image. A 512-byte block size matches the sector geometry fdisk reported, so skip and count are already in the right units.

   Learn more

   dd (disk dump) copies raw bytes between files or devices with precise control over block size, offset, and count. The options used here: if = input file, of = output file, bs=512 = block size in bytes (matching the sector size), skip=2048 = skip the first 2048 blocks from the input (jumping to the Linux partition start), count=51200 = copy exactly 51200 blocks.

   This technique of extracting a partition with dd is fundamental in forensics. It produces a new raw image of just that partition, which you can then pass to any filesystem-aware tool. Without the isolation step, searching the whole disk image would return results from the wrong partition or mix data from multiple locations, making it harder to interpret.

   Alternatively, mount -o loop,offset=$((512*2048)) disko-2.dd /mnt/part can mount the partition directly without extracting it, but using dd to isolate it first is cleaner and avoids any risk of the mount modifying timestamps on the filesystem.

3. Step 3Find the flag with strings

   Observation

   The flag is plain text inside that filesystem, and with the partition carved out, strings plus a grep filter surfaces it without root or a mount.

   Run strings linux-part.dd | grep -i pico on the extracted partition file. The flag is stored as plain text inside the Linux filesystem and appears immediately.

   bash

   strings linux-part.dd | grep -i pico

   Copied!

   What didn't work first

   Tried: Mount the extracted partition with mount linux-part.dd /mnt/part and then use find /mnt/part -type f to manually browse files looking for the flag.

   Mounting needs root and a loop device, and browsing the tree by hand is slower than a strings pipeline. More importantly, anything in a deleted inode or an unallocated block is invisible through the filesystem layer and still visible to strings, so a mount can miss the flag entirely.

   Tried: Run grep -r 'picoCTF' /mnt/part after mounting instead of using strings.

   A recursive grep reads only the live files the filesystem exposes. If the flag sits in a deleted inode or in unallocated space, it finds nothing. strings reads the raw bytes and does not care what the filesystem considers allocated.

   Learn more

   With the Linux partition isolated, strings | grep searches only the relevant filesystem. The flag is embedded as plaintext in the ext2/ext3/ext4 inode or file data area, so it appears in the strings output without needing to mount the partition or navigate its directory tree.

   This challenge teaches the core partition analysis workflow used in real disk forensics: identify the partition layout (fdisk -l or mmls), extract the relevant partition (dd or targeted mount), then apply analysis tools. The same workflow applies whether you are looking for a CTF flag, malware artifacts, or evidence of data exfiltration on a compromised machine.

Flag

Isolate the Linux partition with dd (skip=2048, count=51200), then `strings linux-part.dd | grep pico` reveals the flag.