FAT Keyword Search (Brian Carrier)


CTFs & Images

Test Images
  • General
  • String searches
This test image is a FAT file system with several ASCII strings. The goal of this test is to identify which tools can find different types of strings. Therefore, not all strings shown in the table below will be found. If one of the below strings is not found by a tool, that does not mean that the tool has an error in it. For example, the '1slack1' string crosses between the end of a file and into the slack space of the file. Some tools will find this and others will not. As long as the functionality of the tool is properly documented, then it is up to the user to use his tools in the needed way to gather the possible evidence.