Intergalactic Recovery - Forensics Challenge

Intergalactic Recovery - Forensics Challenge

Summary

Recreating a RAID 5 disk from given disk image files to recover a lost file.

Challenge Intro

Miyuki’s team stores all the evidence from important cases in a shared RAID 5 disk. Especially now that the case IMW-1337 is almost completed, evidences and clues are needed more than ever. Unfortunately for the team, an electromagnetic pulse caused by Draeger’s EMP cannon has partially destroyed the disk. Can you help her and the rest of team recover the content of the failed disk?

Solving Challenge with MDADM

First, download the challenge file and unzip it! You’ll need to enter in the password provided when downloading the file from the HacktheBox website.

When we unzip it, we see that there are 3 .img files. We know that these 3 disks were in a RAID 5 array based on the challenge intro, and we can infer the damaged one (disk starting with 0c) based on file size.

In a RAID 5 with three disks, we only need two intact disks to recover the data. With how RAID 5 handles parity, we can have up to one drive fail. The first thing that we’ll need to do in order to rebuild the RAID disk with the .img files is create loop devices for the two image files that are intact. Make note of the device names (/dev/loop)

udisksctl loop-setup --file 06f98d35.img
udisksctl loop-setup --file fef0d1cd.img

Then, using a software RAID we can rebuild the array and recover the target file. A good resource for using mdadm to create RAID disks is linked here. Using this method did take me a little bit of trial and error in finding the right disk order.

Eventually, we find that the disk order met the following conditions:

  • created a raid disk
  • raid disk was a mountable filesystem
  • when mounted had a non-corrupt pdf file
mdadm --create /dev/md7 --level=5 --raid-devices=3 /dev/loop1 missing /dev/loop0

Opening the file, we can see the flag for the challenge! (Flag is redacted in screenshot below)

And that’s it! There may be other ways to solve this type of challenge, but this is how I solved it during the CTF.