Analyze disk images, mount filesystems, and extract artifacts in CTF forensics challenges.

Disk Image Analysis

Disk image challenges give you a raw copy of a hard drive — .raw, .img, .dd, .vmdk, or .iso. Your job is to mount it, browse the filesystem, and find the flag. The core workflow is simple: identify the filesystem, mount it, search.

Always mount read-only (-o ro) to avoid modifying evidence. In CTFs, the disk image is a forensic snapshot — treat it as immutable.

Analysis Workflow

Step-by-Step Analysis

Identify the image

file disk.img
fdisk -l disk.img

# Example fdisk output:
# Device       Start    End Sectors   Size Type
# disk.img1     2048  206847  204800   100M EFI System
# disk.img2   206848 83886046 ...     39.9G Linux filesystem

fdisk -l tells you the partition layout. The Start column is the sector number — you need this to calculate the mount offset.

Mount the image

# Simple filesystem (not partitioned):
sudo mount -o ro,loop disk.img /mnt/ctf/

# Partitioned (use Start sector from fdisk):
sudo mount -o ro,loop,offset=$((2048 * 512)) disk.img /mnt/ctf/

# Auto with kpartx:
sudo kpartx -av disk.img
sudo mount /dev/mapper/loop0p1 /mnt/ctf/

The offset is Start sector × 512 (bytes per sector). If fdisk shows Start=2048, the offset is 2048 × 512 = 1048576.

Search for flags

grep -r "flag{" /mnt/ctf/ 2>/dev/null
grep -rI "CTF{" /mnt/ctf/ 2>/dev/null
find /mnt/ctf/ -name "*flag*" -type f
find /mnt/ctf/ -name ".*" -type f       # hidden files
cat /mnt/ctf/home/*/.bash_history

Raw string search (without mounting)

strings disk.img | grep -i "flag{"
strings -e l disk.img | grep -i flag    # UTF-16 (Windows)
grep -a "flag{" disk.img

Recover deleted files

sudo apt install sleuthkit
fls -rd disk.img | grep "deleted"
icat disk.img <inode_number> > recovered_file

See Deleted Files for full recovery details.

Filesystem-Specific Commands

sudo apt install e2fsprogs sleuthkit
fsstat disk.img

# List all files including deleted
fls -rd disk.img

# Interactive exploration
debugfs disk.img
# debugfs> ls -l /
# debugfs> lsdel         # deleted inodes
# debugfs> cat <inode>   # view deleted file content
# debugfs> dump <inode> /tmp/out

Interesting Places to Check

cat /mnt/ctf/home/*/.bash_history
cat /mnt/ctf/root/.bash_history
find /mnt/ctf/ -name ".*" -type f          # hidden files
find /mnt/ctf/ -newer /mnt/ctf/etc/passwd  # recently modified
find /mnt/ctf/ -perm -4000                 # SUID binaries
cat /mnt/ctf/var/log/auth.log
cat /mnt/ctf/etc/shadow                    # password hashes

Sleuth Kit Quick Reference

fsstat disk.img                           # filesystem statistics
istat disk.img 12                         # inode information
fls -rd disk.img > all_files.txt          # list all files including deleted
icat disk.img 45 > recovered_file.txt     # recover by inode

Unmounting

sudo umount /mnt/ctf/
sudo kpartx -dv disk.img   # if kpartx was used

Checklist

file disk.img → identify filesystem type
fdisk -l disk.img → find partitions and start sectors
Mount with correct offset (sector × 512)
grep -r "flag{" /mnt/ctf/ — search mounted filesystem
Check /home/*/.bash_history and hidden files
strings disk.img | grep flag (unmounted, raw search)
fls -rd for deleted file listing
icat disk.img <inode> to recover specific deleted file

Last updated on Aug 1, 2025

Disk Image Analysis

On this page