← Back to Writeups
HTBEasyForensics
Bookmark

Intergalactic Recovery

D3v0o0Nu119/2/20262 min read
#forensics#htb#easy

Intergalactic Recovery

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Miyuki's team stores all the evidence from important cases in a shared RAID 5 disk. Especially now that the case IMW-1337 is almost completed, evidences and clues are needed more than ever. Unfortunately for the team, an electromagnetic pulse caused by Draeger's EMP cannon has partially destroyed the disk. Can you help her and the rest of team recover the content of the failed disk?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

  1. First, unzipt the .zip file given, then jump to the extracted directory.

  2. When tried to see the disk size, we know that 0c584923.img might be corrupted because the size is so small.

  3. Based on the description, this chall shall related to RAID 5.

  4. Well i won't explain about RAID 5, you can read the documentation about it here:

https://www.techtarget.com/searchstorage/definition/RAID-5-redundant-array-of-independent-disks
https://www.forensicfocus.com/articles/making-complex-issues-simple-a-unique-method-to-extract-evidence-from-raid-with-lost-configuration/
  1. First, we need to XOR the file with same sizes so we can get the recovered disk, to do this i use pwntools.

THE SCRIPT

 py 
from pwn import *
import os

os.system('clear')

disk1 = read('fef0d1cd.img')
disk2 = read('06f98d35.img')
disk3 = xor(disk1, disk2)

write('disk3.img', disk3) # save the recovered disk

  1. After run the script, strings the disk3.img to see if we can get any clue.

  2. Seems like there's a pdf file inside it, let's run foremost.

  3. Yep it's obviously still corrupted, because we still need to reconfigure the raid 5.

  4. Now before going any further, i already done it to the end and still can't open the pdf file. So i did a small outsource about this problem and found out that we need to switch the disk2 and disk3. What i intend to say is, we need to change the order of the disk. So the disk2 shall renamed to disk3, and disk3 shall renamed to disk2

  5. Now let's use losetup to setup and control loop devices.

sudo losetup /dev/loop1 disk1.img
sudo losetup /dev/loop2 disk2.img
sudo losetup /dev/loop3 disk3.img
  1. Next, let's use mdadm, it's used for manage MD devices aka Linux Software RAID
sudo mdadm --create --level=5 --raid-devices=3 /dev/md0 /dev/loop1 /dev/loop2 /dev/loop3

FOLLOW THIS STEP TO MOUNT THE DISK

sudo mount /dev/md0 /mnt/raid

  1. Check what we get inside.

  2. Let's copy that to our current directory, then open the pdf file.

  3. Got the flg!

Flag

REDACTED

Lessons Learned

  1. Identify the weakness from source review or fingerprinting first.
  2. Iterate with incremental payloads instead of guessing.
  3. Reuse the same pattern in future engagements.