forensicsProeasy
Дед Мороз забыл пароль (forgot_password)
hackerlab
Task: VMware VM image with Windows 10 guest OS. Solution: Extract NTFS partition from VMDK using 7z, then locate flag file on user desktop without booting the VM.
$ ls tags/ techniques/
VMDK disk image extractionNTFS partition analysisUser profile investigationFile system forensics with 7z
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [forensics][Pro]Самосаботаж (Self-Sabotage)— duckerz
- [forensics][Pro]Ищейка (Bloodhound)— duckerz
- [forensics][Pro]Какой-то DMP...— hackerlab
- [forensics][Pro]Мемы с совой (Owl Memes)— hackerlab
- [forensics][Pro]Mem— spbctf