Мемы с совой (Owl Memes)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: Deleted file recovery with icat, Disk image forensics, FAT32 partition analysis

Summary

Task: Disk image with owl memes on a flash drive. Solution: Used mmls to find FAT32 partition, fls to list files and find deleted file marked with asterisk, icat to recover deleted meme7.jpg containing the flag.

Мемы с совой (Owl Memes) — Hackerlab

Description

Мой друг любит хранить мемы с совами на отдельной флешке. Интересно, зачем?

File: owl.zip

Analysis

1. Extracting the archive:

   • owl.zip contains owl_memes.zip
   • owl_memes.zip contains file something (~2GB) — this is a disk image

2. Analyzing disk structure:

 bash read-only • copy allowed Copy
mmls something

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0004194303   0004192256   Win95 FAT32 (0x0b)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

FAT32 partition starts at sector 2048.

1. Listing files on the partition:

 bash read-only • copy allowed Copy
fls -o 2048 something

r/r 4:	meme1.jpg
r/r 6:	meme2.jpg
r/r 8:	meme3.jpg
r/r 10:	meme4.jpg
r/r 12:	meme5.jpg
r/r 14:	meme6.jpg
r/r * 13:	_eme7.jpg

Found a deleted file _eme7.jpg (inode 13), marked with asterisk *.

Solution

Recovering the deleted file using icat:

 bash read-only • copy allowed Copy
icat -o 2048 something 13 > meme7_deleted.jpg

Parameters:

• -o 2048 — partition offset in sectors
• something — disk image file
• 13 — inode number of the deleted file ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Opening the recovered image — it's an owl meme with the flag written on it.

Theory

Why deleted files can be recovered in FAT32:

When FAT32 deletes a file:

1. Replaces the first character of the name with 0xE5 (displayed as _)
2. Marks clusters as free in the FAT table
3. Does NOT overwrite the actual file data

Data remains on disk until overwritten by new files.

The Sleuth Kit Tools

Alternative Tools

• Autopsy — GUI for The Sleuth Kit
• FTK Imager — Windows GUI for forensics
• photorec — automatic file recovery by signatures ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍