Intro to Sleuthkit for Forensics (PicoCTF #39 'sleuthkit-apprentice')

Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeac...
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humbleb...
🐶Snyk ➡ j-h.io/snyk
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsor...
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc

[@yttos7358]

For those who want to do it on the command line you can use `icat` to `cat` out the contents of a specific inode. The inode he displayed in during autopsy was 2371, you also need to tell it the offset `-o` of the filesystem partition you are looking for (use mmls again) and then feed that to `iconv`
So this is what I used at the end of it `iconv

[@ductive]

You can do the same without iconv.

[@lordspacecake5565]

Awsome video, great tool to have.

[@h3bb1]

Hey John, thansk for the videos. They are both fun and super interesting.
I wanted to ask you, do you have a video on what you are doing in the terminal at the end, when you echo out the flag and the finish command? Or is this maybe just basic terminal stuff?

[@Stroopwafe1]

It was in one of the earlier episodes in this series, where the solution was so simple he made those 2 commands. Can't remember exactly which one though, sorry

[@rasraster]

Am I missing something obvious? Couldn't he have just decoded the hex in that flag.uni.txt file, right off the bat?

[@TigerWalts]

Three hundred megabytes of hard drive capacity!
What can that do for you?
Three hundred file cabinets of storage capacity!
That's right
That's on one disk!
You couldn't get close to that on a floppy disk

[@lab-at-home]

That is cool. When I solved this challenge I just extracted the filesystem with binwall and looked into the files, but this tool seems to be really cool

[@feverwilly]

The WIndows version is better it was redone in Java in Windows.

[@chiragvyas5720]

Yeah that is what I also think.

[@forheuristiclifeksh7836]

5:00

[@harsh2314]

Your reactions were relatable... most of the time it needs a simple task for us to solve the problem but we can't just get it 😂

[@bladesvlogs4965]

Wow, that was impressive 👍

[@bhagyalakshmi1053]

Codo automatically shell

[@shiv_sagar72]

great video thnks man

[@moustafakashen3610]

LOVE YOUR CONTENT!

[@Lacsap3366]

All I did in this challenge was to mount the root partition as a loop device by hand and just cat out the flag.uni.txt

[@jorjo1061]

Yeah same but autopsy seems cool as well