Whistleblower

Overview

A 4MB ext2 disk image from a field agent who needed to disappear quickly. They deleted a file containing the flag, but deletion on ext2 just removes the directory entry, the data blocks stay on disk until overwritten.

Solution

Option A: foremost / photorec (recommended)

foremost -i whistleblower_disk.img -o recovered/
ls recovered/txt/
cat recovered/txt/00000000.txt

foremost scans for file headers and recovers any intact files. The deleted text file shows up immediately.

Option B: debugfs

debugfs whistleblower_disk.img
debugfs: ls -d
debugfs: lsdel

lsdel lists deleted inodes. Note the inode number, then:

debugfs: dump <inode> /tmp/recovered.txt
cat /tmp/recovered.txt

Option C: strings

The nuclear option, if the file is plaintext, just scan the raw image:

strings whistleblower_disk.img | grep DEADROP

The Recovered File

The deleted file is a field report titled BURN_NOTICE_KOVACS.txt. It contains operational notes and the flag at the bottom.

Flag: DEADROP{deleted_is_not_gone_rookie_mistake}

Key Takeaway

rm on Linux removes the directory entry and marks inode/blocks as free. It does not zero or overwrite the data. Forensic tools can recover deleted files until the blocks are reused. Secure deletion requires shred, wipe, or full-disk encryption.