# [Timisoara CTF Quals 2018] Strange behavior (Forensics-100pts)

In this task we were given a file of unknown type.

So first, to identify the file type we use `file` linux command:

$ file personal.bin
personal.bin: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "mkfs.fat", sectors/cluster 4, reserved sectors 4, root entries 512, sectors 62500 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 64, sectors/track 32, heads 64, serial number 0x39d716e5, unlabeled, FAT (16 bit)

The file is a `DOS/MBR boot sector` so we can mount it:

$ mkdir personal.dir
$ sudo mount personal.bin personal.dir
$ tree personal.dir
personal.dir
├── 4_next_lectures
│   └── fuuuuuuuun.mp4
├── cyber.jpg
├── panda_udg.jpg
└── profile.jpg

We look at the files but nothing interesting here, so using sleuthkit we look for deleted files:

$ fls -r ./personal.bin
r/r 4: profile.jpg
r/r 6: cyber.jpg
r/r 8: panda_udg.jpg
d/d 11: 4_next_lectures
+ r/r 18247: fuuuuuuuun.mp4
+ r/r * 18249: schedule.xlsx
v/v 997891: $MBR
v/v 997892: $FAT1
v/v 997893: $FAT2
d/d 997894: $OrphanFiles

And we see that there is a deleted file called `schedule.xlsx`, so still using sleuthkit we retrieve it.
Then, using in2csv from csvkit we convert this file to csv to be able to read it in our terminal.

$ icat personal.bin 18249 > schedule.xlsx
$ in2csv schedule.xlsx > schedule.csv
$ cat schedule.csv
"No.
overall","No. in
season",Title,Directed by,Written by,Viewed,
22,1,"""The Rickshank Rickdemption""",Juan Meza-León,Mike McMahan,x,
23,2,"""Rickmancing the Stone""",Dominic Polcino,Jane Becker,x,
24,3,"""Pickle Rick""",Anthony Chun,Jessica Gao,x,
25,4,"""Vindicators 3: The Return of Worldender""",Bryan Newton,Sarah Carbiener & Erica Rosbe,x,
26,5,"""The Whirly Dirly Conspiracy""",Juan Meza-León,Ryan Ridley,x,
27,6,"""Rest and Ricklaxation""",Anthony Chun,Tom Kauffman,x,
28,7,"""The Ricklantis Mixup""[b]",Dominic Polcino,Dan Guterman & Ryan Ridley,x,
29,8,"""Morty's Mind Blowers""",Bryan Newton,"Mike McMahan, James Siciliano, Ryan Ridley,
Dan Guterman, Justin Roiland & Dan Harmon",x,
30,9,"""The ABC's of Beth""",Juan Meza-León,Mike McMahan,timctf{d0nt_f0rg3t_t0_h4v3_fun},
31,10,"""The Rickchurian Mortydate""",Anthony Chun,Dan Harmon,x,

**Et voilà !**