[iDaniel19]

I'm trying a level about forensics on a forum. I have a .img file which I've been trying to recover. In windows i tried 4 tools,but only one sort of worked and I can t open any of the files. I analysed the file with trid and I got back that is: 40.2% .ATN, 16,1%.WK etc(I don't know if it helps).I also installed linux and ran fdisk -l forensics1.img and I get

fdisk -l forensics1.img

Disk forensics1.img: 25 MiB, 26214400 bytes, 51200 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Could someone give me any ideas about how to open the file ?

[How bout using your brain]

That is all the output of fdisk -l? There should be more

[iDaniel19]

Yeah.. that s all that I got. What do you mean by 'no, you can't decrypt a hash' ? I'm supposed to recover the files somehow. It's a level that I have to pass

[How bout using your brain]

Yeah.. that s all that I got. What do you mean by 'no, you can't decrypt a hash' ? I'm supposed to recover the files somehow. It's a level that I have to pass

that is just my signature, not related to this topic at all.



ontopic:

Do the following:

Code

mount -o loop yourfile.img /some/folder

If that doesn't work then do this:

Code

dd if=yourfile.img | file -

And tell me the output

[iDaniel19]

Tried the first one but I just get an empty folder. As for the second one I get

Code

dd if=forensics1.img | file -
/dev/stdin: Linux rev 1.0 ext4 filesystem data, UUID=3252234c-f5e0-4ed4-a809-beb029819989, volume name "Forensics" (extents) (huge files)

. What does that mean and what does the command do ? Sorry for your signature but I missed the black line :D:D

[How bout using your brain]

You should be able to mount the image like this:

Code

mount -t ext4 -o loop forensics1.img /some/folder

[iDaniel19]

You should be able to mount the image like this:

Code

mount -t ext4 -o loop forensics1.img /some/folder

It's still empty ...