# Disk,disk,sleuth!
Category: Forensics AUTHOR: SYREAL
**Disclaimer! I do not own any of the challenge files!**
## Description```Use `srch_strings` from the sleuthkit and some terminal-fu to find a flag in this disk image: dds1-alpine.flag.img.gz```
## The image
After downloading the image, I used `gunzip` to unzip it and then ran `srch_strings` just as recommended. 
*NOTE: srch_strings is part of the sleuthkit, which you can downloade [here](https://sleuthkit.org/sleuthkit/download.php)*
```srch_strings dds1-alpine.flag.img...mousemousedev.koseriopsmouse.ko@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`@1,`hyperv-keyboard.kopcips2.kobcachedm-bio-prison.koHpdm-bufio.kodm-cache-smq.kodm-cache.kodm-crypt.kodm-delay.kodm-flakey.koNpdm-log-userspace.kodm-log-writes.koPpdm-log.kodm-mirror.koRpdm-mod.kodm-multipath.kodm-queue-length.kodm-raid.kodm-region-hash.kodm-round-robin.kodm-service-time.kodm-snapshot.kodm-switch.ko[pdm-thin-pool.kodm-unstripe.ko...```But the output is absolutely massive... Hey, maybe we can just do a simple grep?```srch_strings dds1-alpine.flag.img | grep picoffffffff81399ccf t pirq_pico_getffffffff81399cee t pirq_pico_setffffffff820adb46 t pico_router_probe  SAY picoCTF{f0r3ns1c4t0r_n30phyt3_267e38f6}```Flagalicious! 