# Forensic: hide and split

## Task:

```
Author: underzero

Explore this disk image file, maybe you can find something hidden in it.
```

## Solution:

Attached is challenge.zip, which, when unzipped, reveals a file called challenge.ntfs.

In this writeup, I will show 2 ways to solve this challenge.

### Solution 1: Strings

In this solution, we utilize regex to get our answer. First of all, let's run `strings challenge.ntfs` and see the results.


Hmm...Nothing interesting...

Anyways, scrolling down a bit more, you find these set of strings:


Ah, cool hexadecimal text. If you've done some forensic before, you might recognize those first few hex bytes from the first file, 89 50 4e is the first few magic numbers for a PNG file.

From this information, you can safely say that these random hexadecimal strings form an image. Cool, but can we extract these all without unzipping the challenge.ntfs file?

The answer is yes! I utilized `egrep` for this one.

`strings challenge.ntfs | egrep -o '^(?:[0-9a-f]){16,}$'`

Let's see the result...


Cool, we have them all. Now, we just remove all the new lines and translate it from hex (I used [cyberchef](https://gchq.github.io/CyberChef/) for this), and once you do that, you will get an image with a QR code.


Scan it, and you get:

`TCP1P{hidden_flag_in_the_extended_attributes_fea73c5920aa8f1c}`

### Solution 2: Actually "unzipping" it

This solution was how I originally solved it. I just extracted the ntfs file with 7z, and it results in these files showing up:


Anyways, the flag-[number].txt just contains
```
Unfortunately this is not the flag
The flag has been split and stored in the hidden part of the disk
```

However, the flag[number].txt/flag[number] files contain hexadecimal value. Similar to solution 1, I just piped all the hexadecimal text into a file called hex.txt, then used cyberchef to convert it from hex to image. Anyways, you get the flag from both solutions.

## Flag:

`TCP1P{hidden_flag_in_the_extended_attributes_fea73c5920aa8f1c}`

## Notes & Extras:

umm...i realized that newlines existed. i could've solved this challenge earlier. newlines screwed the final image. shoutout to my teammate xtrimi for telling me this LOL