[{"_1":2,"_33":-5,"_34":-5},"loaderData",{"_3":4},"routes/challenges.$slug",{"_5":6},"challenge",{"_7":8,"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_30":31},"slug","gone","name","Gone","category","Digital Forensics","description","SCENARIO A cloned filesystem from a target device. The sensitive documents inside have been redacted, and whoever handed this over is confident nothing useful remains. Take a closer look. The files are there, the data appears gone, but filesystems have a habit of holding onto things longer than people expect. Flag format: FLAG{} Infrastructure - Downloadable File Provided Files - Gone.zip (102.3 KB)","descriptionHtml","

SCENARIO

A cloned filesystem from a target device. The sensitive documents inside have been redacted, and whoever handed this over is confident nothing useful remains.

Take a closer look. The files are there, the data appears gone, but filesystems have a habit of holding onto things longer than people expect.

Flag format: FLAG{}

Infrastructure

- Downloadable File

Provided Files

- Gone.zip (102.3 KB)

","labDetails","Prerequisites & Requirements Linux file systems: Particularly the ext4 file system architecture Block allocation: How file systems allocate storage blocks to files Slack space fundamentals: Understanding what happens to unused bytes within allocated blocks Basic forensics concepts: Disk imaging and evidence preservation principles Command-line proficiency: Comfortable working with Linux terminal tools Access to a Linux environment (native or VM) since most forensics tools work best there What Will You Learn? Ext4 file system internals: Understanding inodes, block mappings, and metadata structures Slack space forensics: A critical technique for recovering hidden or deleted data Using debugfs: The ext2/3/4 debugging utility for filesystem analysis Data recovery from raw blocks: Extracting bytes directly from disk images Gzip decompression: Identifying and extracting compressed data streams Tools dumpe2fs: Inspect ext4 superblock and filesystem metadata debugfs: Interactive debugger for ext2/3/4 filesystems dd: Raw data extraction from specific offsets grep: Pattern searching (including binary patterns) hexdump: Viewing raw bytes in hexadecimal format gzip / python3: Decompressing gzip-compressed data","labDetailsHtml","

Prerequisites & Requirements

Linux file systems: Particularly the ext4 file system architecture
Block allocation: How file systems allocate storage blocks to files
Slack space fundamentals: Understanding what happens to unused bytes within allocated blocks
Basic forensics concepts: Disk imaging and evidence preservation principles
Command-line proficiency: Comfortable working with Linux terminal tools
Access to a Linux environment (native or VM) since most forensics tools work best there

What Will You Learn?

Ext4 file system internals: Understanding inodes, block mappings, and metadata structures
Slack space forensics: A critical technique for recovering hidden or deleted data
Using debugfs: The ext2/3/4 debugging utility for filesystem analysis
Data recovery from raw blocks: Extracting bytes directly from disk images
Gzip decompression: Identifying and extracting compressed data streams

Tools

dumpe2fs: Inspect ext4 superblock and filesystem metadata
debugfs: Interactive debugger for ext2/3/4 filesystems
dd: Raw data extraction from specific offsets
grep: Pattern searching (including binary patterns)
hexdump: Viewing raw bytes in hexadecimal format
gzip / python3: Decompressing gzip-compressed data

","level","Medium","tags",[25,26,27,28,29],"Ext4","Slack Space","Data Recovery","File Carving","Dead Box Forensics","jobPositions",[32],"Security Analyst","actionData","errors"]

Gone

Overview

SCENARIO

Infrastructure

Provided Files

Job Positions

Tags