Forensic analysis plays a crucial role in cybersecurity investigations, helping ethical hackers and security analysts recover lost or deleted data to uncover hidden evidence. One popular platform for practicing digital forensics is Root Me, which offers a variety of challenges, including Deleted File Forensic challenges.
In this blog, we’ll walk you through solving a Deleted File Forensic challenge on Root Me, explaining key forensic techniques and tools used in real-world investigations.
First, we need to initiate the challenge, which provides us with a downloadable file. According to the challenge statement, the file pertains to a USB drive, and our task is to identify its owner.
so we can notice after we extracting the gz file that the file hasn’t extension, its just usb.image
so, we need to perform forensic analysis using FTK Imager (you can download it from the highlight)
we can find that it’s a file that we can use in FTK Imager to start forensic
we can see that there is a usb.image in the file as we saw before, also there is mkfs.fat and it is used to create a FAT filesystem in an image file.
so, we can export the usb.image to open it in FTK to see what its content.
we need to search for something interesting that may lead to the flag, if we look at the root folder, we can see anonyme.png and it may contain the flag
we need to convert it to text to see its content
Flag – javier_turcot
Become a Certified Digital Crime Investigator with A7 Security Hunters.
