Basic Data Carving Test #2 (Brian Carrier)

Hot
198

CTFs & Images

Test Images
  • General
  • Linux
This test image is an EXT2 file system and is intended to test data carving tools for indirect block detection and removal. With large files, EXT2 allocates blocks (called indirect blocks) to store file metadata and the blocks are frequently allocated in between blocks that contain file content. Therefore, the file becomes fragmented and a basic carving tool may include the indirect block in the carved file. This file system image contains several allocated and deleted files, none of which have been modified. This image was created from a USB thumb drive that was wiped clean and formatted using the mkfs.ext2 program. The super block has been corrupted so that the image cannot be mounted and therefore data carving methods must be used to extract the files.