{"id":854,"date":"2020-10-01T23:33:51","date_gmt":"2020-10-01T22:33:51","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=854"},"modified":"2020-10-01T23:33:51","modified_gmt":"2020-10-01T22:33:51","slug":"disk-forensics-p9","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=854","title":{"rendered":"Disk Forensics P9"},"content":{"rendered":"

After learning howto create a disk image (acquire disk image), we need to know how to mount this files and use it for further analysis.<\/p>\n

\n

Image mounting involves mounting the evidence disk image on the local system so the data on the disk can be analyzed and inspected.<\/p>\n

In this lab, an evidence hard disk image is present on an external disk mounted on \u2018\/dev\/sdc\u2019. The dd tools<\/b><\/a>\u00a0are installed on the lab machine. Also, a flag file is kept in the \/root directory of the disk image filesystem.<\/p>\n

Objective:<\/b>\u00a0Mount the evidence disk image and retrieve the flag!<\/p>\n<\/blockquote>\n

First let’s check if \/dev\/sdc is mounted<\/p>\n

\"\"<\/a><\/p>\n

I’ll change the directory to \/mnt\/evidence<\/p>\n

\"\"<\/a><\/p>\n

From there I’ll copy the evidence.img file to the root directory<\/p>\n

cp evidence.img \/root<\/code><\/p>\n

file evidence.img<\/code><\/p>\n

\"\"<\/a><\/p>\n

From here we’ll create a directory called «analysis»<\/p>\n

mkdir analysis<\/code><\/p>\n

mount evidence.img \/analysis<\/code><\/p>\n

df -h<\/code><\/p>\n

\"\"<\/a><\/p>\n

cd \/analysis\/root<\/code><\/p>\n

cat flag.txt<\/code><\/p>\n

\"\"<\/a><\/p>\n

\n","protected":false},"excerpt":{"rendered":"

After learning howto create a disk image (acquire disk image), we need to know how to mount this files and use it for further analysis. […]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":859,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,16],"tags":[],"class_list":["post-854","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forensic","category-linux"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=854"}],"version-history":[{"count":3,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/854\/revisions"}],"predecessor-version":[{"id":865,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/854\/revisions\/865"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/859"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}