Digital Forensics(disk.img) | Finals eycc 2025

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ اللَّهُــمَّ صَلِّ وَسَـــلِّمْ وَبَارِكْ على نَبِيِّنَـــا مُحمَّدﷺ

HI folks! I’m Abdallah Magdy, I was part of Finals of the first CTF compotation for high school students in Egypt, and my team is “Zeroday team” My friends in the team :

أحمد ياسر

@mohamed shrief

@mohamed raoof

The compotation was very hard, there were 8 challenges and only 5 solved from 20 teams!!

My team was the first blood after in the whole compotation after 3 hours! but unfortunately we reached the fourth team :/ , alhamdulillah

Anyway today I’ll talk about the unsolved forensics challenge

intercept

There’s no description for this challenge, you have a disk image so you should find the root directory

What is disk img challenge?

This is a popular type of challenges in forensics, A disk image file is a single file that contains a complete copy of a storage device’s data and structure. It preserves partitions, file systems, and even boot sectors in one container

With **mmls, you list the partition table of a disk image and identify the start sector of the partition. Then, using `fls -o [start sector]`**, you can explore the filesystem inside that partition and list its files and directories, so when i did this to the challenge this is what happened

LUKS? what is this

What is Luks encryption for CTF challenges?

LUKS encryption in CTFs usually appears as an encrypted disk or partition. To solve it, you try to unlock it using a passphrase or key (often via brute-force with tools like hashcat or john), and once unlocked, you can mount it and explore the hidden files.

in this challenges it was way difficult, there’s tools to decrypt it with the pass, but we don’t have a real LUKS file, so we should isolate the byte offset in a file then decrypt it You first calculate the byte offset with START * 512 to point exactly at the partition inside the disk image. Then, with:

OFFSET=$((2048*512))

This is var is the number of bytes that contains the encrypted file so we make another var Who will be the file

LOOP=$(sudo losetup --find --show -o $OFFSET disk.img)

• losetup is a Linux tool used to associate a loop device (like /dev/loop0) with a regular file. It allows the file to be accessed as if it were a block device (like a hard disk)
• --find tells losetup to automatically pick the first available loop device (e.g., /dev/loop0)
• --show makes it print the name of the loop device it assigned.
• -o $OFFSET specifies the offset in bytes inside the file where the loop device should start (so you can map only a partition or section of the file, not the whole thing).
• disk.img is the raw disk image you’re working on.

Finally, the result (the loop device path, e.g., /dev/loop0) is stored in the shell variable LOOP.

➝ So in short: this command maps the partition at the given offset of disk.img to a loop device, and saves that device path in LOOP

Finally we have a real file that contains the encrypted LUKS folder but we don’t have the pass right, so now i should tell that usually in ctfs we brute force the pass to get it, you can’t decrypt it without the pass or keyfile,

if you tried to brute force with any wordlist you won’t be able to open it! so what is the pass?? it’s the name of the compotation!! eycc is the password, it was mt first time to see a LUKS encryption so i didn’t know what I should do, any ways forget my sad story and let’s continue

To deal with the file LOOP(dev/loop0) we will use cryptsetup which is a tool made for LUKS encryption

sudo cryptsetup luksOpen $LOOP luks_ctf

• cryptsetup: A Linux tool used to manage LUKS encrypted volumes, and will store the file in /dev/mapper
• luksOpen: The action that opens (decrypts) a LUKS-encrypted device
• $LOOP: The loop device that points to the encrypted section of the disk image, you can’t use /dev/loop0 as it’s already in use in LOOP var
• luks_ctf: The name you assign to the unlocked mapping, which will appear under /dev/mapper/luks_ctf

after you wrote this command it will ask for the pass, and it’s ‘eycc’ as i said, you had finished 90% of the challenge! all that remains is to cahnge/dev/mapper/luks_ctf to another palce to read it

Creates an empty directory that will be used as the mount point (the place in the filesystem tree where the decrypted filesystem will appear).

sudo mkdir /mnt/luks_ctf

Tells the kernel to attach (mount) the filesystem stored on the block device /dev/mapper/luks_ctf at the directory /mnt/luks_ctf

sudo mount -o ro /dev/mapper/luks_ctf /mnt/luks_ctf

then show the file with

ls -la /mnt/luks_ctf

finally!!!! we’ve reached the files, Not to waste time the emails directory contains two files .bash_history and file.txt, cat .bash_history and TADA!!!!

the challenge wasn’t hard but this was my first time to deal with LUKS encryption, so I might have said something wrong, and I would be happy if someone corrected me, because this is the first time I have used most of these tools.

THANK YOU !