Target: : USB drive "ch39.gz"

Objective

find the USB drive's owner

Recon

the target is an archived file named ch39.gz, once we open it we end up with an file with an .image prefix

we can either mount it , or use an extractor tool, i choose to start with the second one using 7zip

the image is not really empty, and yet 0 files was founds, so the file has to be deleted (it's in the title, duh). sleuthkit is a forensic toolkit that can recover deleted files, so that should do the trick

great, there is an image, now we extract it using icat

if we take a look at the image, we se a plain image of trees, obviously the flag wouldn't be hided at plain sight, it's probably in the EXIF metadata or in the HEX format (we do this for steganography)

Exploitation

let's start with the EXIF metadata using exiftool

Result

well that was easy, the creator name is Javier Turcot, our flag.

flag = javier_turcot

What I Learned

• how to recover deleted files using sleuthkit and icat
• how to read EXIF metadata using exiftool
• ctrl + or ctrl - zoom and un-zoom the terminal font (i typed it by accident)