Tags: forensics stego 

Rating:

# Disk, disk, slueth! II

![bi0s](https://github.com/a3X3k/Bi0s/blob/master/CTFs/Pico21/Assets/10.png?raw=true)

- Download the `gz` file and extract it.
- We shall get the `Disk image` file.
- Extract the `Disk Image`.
- Navigating to `Disk Disk Slueth! II\dds2-alpine.flag.img\dds2-alpine.flag\root` will give `down-at-the-bottom.txt` file.
- It contains the flag.
- One more approach is to mount the file and analyze it using `Autopsy`.

```
_ _ _ _ _ _ _ _ _ _ _ _ _
/ \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \
( p ) ( i ) ( c ) ( o ) ( C ) ( T ) ( F ) ( { ) ( f ) ( 0 ) ( r ) ( 3 ) ( n )
\_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/
_ _ _ _ _ _ _ _ _ _ _ _ _
/ \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \
( s ) ( 1 ) ( c ) ( 4 ) ( t ) ( 0 ) ( r ) ( _ ) ( n ) ( 0 ) ( v ) ( 1 ) ( c )
\_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/
_ _ _ _ _ _ _ _ _ _ _
/ \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \
( 3 ) ( _ ) ( 0 ) ( d ) ( 9 ) ( d ) ( 9 ) ( e ) ( c ) ( b ) ( } )
\_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/
```

```
Flag --> picoCTF{f0r3ns1c4t0r_n0v1c3_0d9d9ecb}
```

Original writeup (https://github.com/a3X3k/Bi0s/tree/master/CTFs/Pico21/Disk%2C%20disk%2C%20slueth!%20II).