Corrupted disk
[Misc]
Corrupted disk
We've recovered this disk image but it seems to be damaged. Can you recover any useful information from it?
Recon
Seems we can't mount this image file.
$ file recovered_disk.img
recovered_disk.img: data
Good thing we have our friend binwalk.
$ binwalk --dd=".*" recovered_disk.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
76464 0x12AB0 PDF document, version: "1.4"
76535 0x12AF7 Zlib compressed data, default compression
76774 0x12BE6 Zlib compressed data, default compression
87882 0x1574A Zlib compressed data, default compression
92848 0x16AB0 PNG image, 329 x 17, 8-bit grayscale, non-interlaced
273072 0x42AB0 Zip archive data, at least v2.0 to extract, name: _rels/.rels
273346 0x42BC2 Zip archive data, at least v2.0 to extract, name: word/settings.xml
273595 0x42CBB Zip archive data, at least v2.0 to extract, name: word/_rels/document.xml.rels
273971 0x42E33 Zip archive data, at least v2.0 to extract, name: word/fontTable.xml
274385 0x42FD1 Zip archive data, at least v2.0 to extract, name: word/numbering.xml
275259 0x4333B Zip archive data, at least v2.0 to extract, name: word/media/image1.jpeg
375699 0x5BB93 Zip archive data, at least v2.0 to extract, name: word/charts/chart1.xml
376594 0x5BF12 Zip archive data, at least v2.0 to extract, name: word/styles.xml
377822 0x5C3DE Zip archive data, at least v2.0 to extract, name: word/document.xml
382592 0x5D680 Zip archive data, at least v2.0 to extract, name: docProps/app.xml
382823 0x5D767 Zip archive data, at least v2.0 to extract, name: docProps/core.xml
383169 0x5D8C1 Zip archive data, at least v2.0 to extract, name: [Content_Types].xml
384353 0x5DD61 End of Zip archive, footer length: 22
387760 0x5EAB0 JPEG image data, EXIF standard
387772 0x5EABC TIFF image data, little-endian offset of first image directory: 8
486064 0x76AB0 PNG image, 1068 x 966, 8-bit/color RGBA, non-interlaced
486128 0x76AF0 Zlib compressed data, best compression
500566 0x7A356 Zlib compressed data, default compression
1829552 0x1BEAB0 JPEG image data, JFIF standard 1.01
1829582 0x1BEACE TIFF image data, little-endian offset of first image directory: 8
1829844 0x1BEBD4 JPEG image data, JFIF standard 1.01
Solution
We carve out the PNG file(s) and find the flag.
Flag
gigem{wh3r3_w3r3_601n6_w3_d0n7_n33d_h34d3r5}