Check yourself so you won't wreck yourself
Category: Forensics
100 Points
Solved by the LordOfTheFlags Team
Solution:
First off we would like to know what kind of file we will be working with, that is checked with the linux file utility as shown below:
```ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ file checkyourself.E01 checkyourself.E01: EWF/Expert Witness/EnCase image file format```So we see that it a file that is used with Encase. Searching the internet we can fild an example of someone mounting the file and being able to navigate through the file system inside(https://www.andreafortuna.org/2018/04/11/how-to-mount-an-ewf-image-file-e01-on-linux/).
Using the example commands provided in the article we were able to perform the following steps to mount ththe filesystem:
```ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$  mkdir mount_encaseghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$  mkdir windows_fsghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ sudo ewfmount checkyourself.E01 mount_encase/efwmount 20140807
```
Now to see what is inside of the E01 file we use the fdisk utility to list the different partitions as show below:
```ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ sudo fdisk -l mount_encase/ewf1Disk mount_encase/ewf1: 40 GiB, 42949672960 bytes, 83886080 sectorsUnits: sectors of 1 * 512 = 512 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisklabel type: gptDisk identifier: E1EE055D-4293-4322-9DB1-11480F3861EB
Device                Start      End  Sectors  Size Typemount_encase/ewf1p1    2048  1085439  1083392  529M Windows recovery environmentmount_encase/ewf1p2 1085440  1288191   202752   99M EFI Systemmount_encase/ewf1p3 1288192  1320959    32768   16M Microsoft reservedmount_encase/ewf1p4 1320960 83884031 82563072 39.4G Microsoft basic dataghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$```Now we can see that there is an Microsoft basic data located at 1320960 witht he size of 39.4G, that seems like an interesting partiton to mount and bropwse around in.We can mount the pattition with the following command taken from the example we found earlier:
```ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ sudo mount ./mount_encase/ewf1 ./windows_fs -o ro,loop,show_sys_files,streams_interace=windows,offset=$((1320960*512))ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ ls windows_fs'$AttrDef'      '$Secure'                 'Program Files (x86)''$BadClus'      '$UpCase'                  Recovery'$Bitmap'       '$Volume'                  swapfile.sys'$Boot'         'Documents and Settings'  'System Volume Information''$Extend'        pagefile.sys              Users'$LogFile'       PerfLogs                  Windows'$MFTMirr'       ProgramData'$Recycle.Bin'  'Program Files'ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$```So we can see that there is a bunch of windows files in here, we know that the flag starts with BSIDES so we do a recursive search for that string using grep as shown below:
```ghostcat@LordOfTheFlags:~/Documents/BsidesTLV/Forensics/checkyoself$ grep -inr BSIDESgrep: $Extend/$ObjId: No such file or directorygrep: $Extend/$Quota: No such file or directorygrep: $Extend/$Reparse: No such file or directorygrep: $Extend/$UsnJrnl: No such file or directory$Recycle.Bin/S-1-5-21-3498983559-1615527653-2205644034-1001/$R0K6T9B.txt:1:BSIDESTLV{ICanSeeYouUnlessYouCleanUpAfterYourself}grep: $Secure: No such file or directoryBinary file pagefile.sys matchesgrep: Program Files/WindowsApps/Microsoft.GetHelp_10.2004.31291.0_x64__8wekyb3d8bbwe/Microsoft.Apps.Stubs.Handoff.winmd: Input/output errorgrep: Program Files/WindowsApps/Microsoft.GetHelp_10.2004.31291.0_x64__8wekyb3d8bbwe/AppxBlockMap.xml: Input/output errorgrep: Program Files/WindowsApps/Microsoft.GetHelp_10.2004.31291.0_x64__8wekyb3d8bbwe/AppxManifest.xml: Input/output errorgrep: Program Files/WindowsApps/Microsoft.GetHelp_10.2004.31291.0_x64__8wekyb3d8bbwe/clrcompression.dll: Input/output errorgrep: Program Files/WindowsApps/Microsoft.GetHelp_10.2004.31291.0_x64__8wekyb3d8bbwe/GetHelp.dll: Input/output error........ snipped```
And there is the flag: BSIDESTLV{ICanSeeYouUnlessYouCleanUpAfterYourself}
