i using "lsof" to find deleted file
![](https://miro.medium.com/max/764/1*fWE30tfV3ZRZr_xiL24PRw.png)
and i copy that file to new file
![](https://miro.medium.com/max/764/1*M4qdcj9N3PLtE_ujZtTMDg.png)
and login```su -l wolf2```
and i looking around and get the flag in proc directory
![](https://miro.medium.com/max/756/1*UXYTaTwSkYT7uTnfF6VR3Q.png)
> Flag: darkCTF{w0ahh_n1c3_w0rk!!!}
[my blog](http://medium.com)