Recovering From the Snap

Recovering From the Snap

Points: 150

Category

Forensics

Question

There used to be a bunch of animals here, what did Dr. Xernon do to them?

Hint

Some files have been deleted from the disk image, but are they really gone?.

Solution

install photoRec [as per your OS and architecture] https://www.cgsecurity.org/wiki/TestDisk_Download

run photoRec animals.dd

It will recover 4 .JPG files
3 of them are animal photos and 4th one contains the flag.

Flag

picoCTF{th3_5n4p_happ3n3d}