Скрытый след (Hidden Trail)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-05 | Status: Solved Techniques: Raw filesystem string extraction, Deleted file data recovery, Filesystem image analysis

Summary

Category: Forensics Difficulty: Medium (350 points) Flag format: CODEBY{...}

Скрытый след (Hidden Trail) — HackerLab

Description

"Какой-то unnamed таит в себе секреты..." (Something unnamed hides secrets...)

Category: Forensics
Difficulty: Medium (350 points)
Flag format: CODEBY{...}

Analysis

Step 1: Extracting the archive

Download and extract data.zip:

 bash read-only • copy allowed Copy
unzip data.zip

We get a single file data.

Step 2: File identification

 bash read-only • copy allowed Copy
file data

data: Linux rev 1.0 ext4 filesystem data, UUID=8bea0ea3-3601-46b5-8f72-e5c4ec686c14 (extents) (64bit) (large files) (huge files)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The file is a Linux ext4 filesystem image approximately 104MB in size.

Step 3: Interpreting the hint

The key word in the description is "unnamed". In the context of filesystems, this points to:

• Deleted files (that lost their name in the directory)
• Hidden data
• Data without inode binding

Step 4: Finding the flag

Since deleted files can leave data in unused filesystem blocks, we use strings to extract text strings directly from the image:

 bash read-only • copy allowed Copy
strings data | grep -iE "CODEBY|flag"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# solve.sh - Hidden Trail

# Extract
unzip -o data.zip

# Identify the file
file data

# Search for flag in raw filesystem data
strings data | grep -iE "CODEBY"

Result

The strings command found:

1. The flag in plain text
2. References to deleted files: flag.png, flag_2.png, ... flag_9.png

Flag breakdown

The flag REDACTED = "recovering deleted data always helps".

This confirms that the intended solution was recovering deleted data from the ext4 image.

Alternative Methods

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

For deeper analysis, you can use:

 bash read-only • copy allowed Copy
# Mount the image (read-only)
sudo mount -o ro,loop data /mnt/forensics

# Recover deleted files with extundelete
extundelete data --restore-all

# Analysis with Autopsy/Sleuth Kit
fls -r data
icat data <inode_number>

# Carving with foremost/scalpel
foremost -i data -o output/

Conclusions

1. Simple solution — strings + grep is sufficient to extract a text flag
2. "Unnamed" hint — direct indication of deleted/hidden data
3. Flag confirmation — the flag text explains the intended solution method
4. Basic forensics skill — ability to work with filesystem images and recover data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍