Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Find Deleted File Traces in NTFS $MFT
Mission
Analyze `mft_records.txt`, a dump of the NTFS Master File Table, to recover information about deleted files. A NOT_ALLOCATED (deleted) record whose resident $DATA was not overwritten still contains the flag.
Not started
Hints
Hint 1Show
Isolate the NOT_ALLOCATED (deleted) records from mft_records.txt
Hint 2Show
A deleted-but-not-overwritten resident ($DATA) file still holds its content
Hint 3Show
The flag is in that single record's resident data (TextPreview)