Rating:
# hide and split
We are provided with a `.ntfs` image, which is a file system format that can be parsed by [Autopsy](https://www.autopsy.com). After looking for a while we can see that the only files inside of the image are numbered txt files:
The `flag{number}.txt` files do not contain anything useful, but the companion files (`flag{number}.txt:flag{number}`) all contain different text:
These companion files use something called alternate data streams (or ADS) for storing data. It cannot be read very easily on windows, so malware will sometimes leverage this to hide data or executables.
Anyway, after extracting all interesting files we can use a small script to concatenate their contents and display it as a single string:
```python
import os
def get_filtered_files(directory='.'):
return sorted(
(int(file_name.split('flag')[1][:-5]), file_name)
for file_name in os.listdir(directory)
if os.path.isfile(file_name) and not file_name.endswith(('.txt', '.py'))
)
def read_concatenated_content(files):
return ''.join(
open(file_name, 'r').read().strip()
for _, file_name in files
)
if __name__ == "__main__":
filtered_files = get_filtered_files()
concatenated_content = read_concatenated_content(filtered_files)
print(concatenated_content)
```
Flag: `TCP1P{hidden_flag_in_the_extended_attributes_fea73c5920aa8f1c}`
