Skip to main content

Deleted file

  • Description: Your cousin found a USB drive in the library this morning. He's not very good with computers, so he's hoping you can find the owner of this stick! The flag is the owner's identity in the form firstname_lastname
  • Difficulty: Very Easy

🔎 Solution​

The provided file is a USB image. To analyze it, we can use FTK Imager. Start by selecting Image File under the Select Source option to load the image.
Once loaded, navigate to the /root directory, where an image file is located. Right-click on the image and choose Export Files to extract it.

After exporting, view the file's Properties. From the metadata, we can identify the owner of the image as Javier Turcot.

🚩Flag​

javier_turcot