Recovery from slack space

Labs need a computer

Open this page on a computer, or make the browser window larger.

Files

forensics-slack.zip
Size: 7.7 KB
SHA-256
aa65989ccfa4eb2e69cfea71153d8752842fdbb996a34bc0b56493e012028a82
Download

After downloading, compare the file SHA-256 with the value shown here to make sure it arrived intact.

Tools you may need

strings
To extract text from the image.
bulk_extractor
To extract evidence from slack space.

Scenario

The Ravens wiped a drive, but two notes survive in slack space, each fenced by a marker. One is stale, the current one carries the master stash code. This is the leader showdown.

What you are looking at

You download forensics-slack.zip with drive.img, an apparently wiped image holding two notes in slack space, one a decoy.

Goal

Recover both notes, tell the current from the stale, and read the flag.

What counts as solved

You enter the correct flag.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Extract the strings from drive.img.
Find the two notes between the markers.
Tell the stale from the current.
Read the flag from the current one.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.