AF-0DFB-D1 · Disk
Clean Start
DOWNLOADABLE real image. No anti-forensics, entry level: carve the deleted document, find its owner, and correctly report the overwritten region as unrecoverable.
Scenario
A raw disk image. A deleted document is intact as data and recoverable by carving; the document embeds its owner. A second file is securely deleted, that is, overwritten. Correctly reporting it as 'unrecoverable' is baseline soundness.
Anti-forensics techniques
- None (AF-0, baseline)
Provided artifacts
- Raw disk image (4 MiB)
Sample questions
- q1: What is the flag in the carved document?
- q2: Who is the owner of the document?
- q3: Is the second, overwritten file recoverable?
Soundness trap
A tool claiming to recover the overwritten file is heavily penalized; 'permanently lost' is the correct answer.
Scoring
Recall-weighted + 1 soundness trap.
DOWNLOADABLE
Download and solve
The answer key is hidden (scored set); the flag is encrypted, you must decrypt it.