Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Find Deleted File Traces in NTFS $MFT
Mission
Analyze `mft_records.txt`, a dump of the NTFS Master File Table, to recover information about deleted files. A NOT_ALLOCATED (deleted) record whose resident $DATA was not overwritten still contains the flag.
Hints
Hint 1 Show
Isolate the NOT_ALLOCATED (deleted) records from mft_records.txt
Hint 2 Show
A deleted-but-not-overwritten resident ($DATA) file still holds its content
Hint 3 Show
The flag is in that single record's resident data (TextPreview)