forensicsProeasy
Reincarnation
duckerz
Task: recover deleted files from an ext4 filesystem image. Solution: search for gzip magic bytes in the raw image, extract and decompress hidden gzip streams, then decode a multi-layer chain (Base32, Base64, TAR, gzip) to obtain the flag.
$ ls tags/ techniques/
magic_bytes_searchfile_carvingmulti_layer_decodingfilesystem_analysis
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [reverse][Pro]Cursed Steganography— duckerz
- [forensics][Pro]Скрытый след (Hidden Trail)— hackerlab
- [forensics][Pro]Time Capsule— tamuctf
- [misc][Pro]Kotik (Cat)— duckerz
- [forensics][free]Lavender— alfactf