4

I'm currently trying to find a file that was hidden in sector 2047. My root partition starts at sector 2048.
How would I go about finding that file? Given the only info I have is the sector its in.
Thanks in advance!

  • 6
    Just so everyone knows, this question is a forensics question in the cyberpatriot competition state round in the year 2019 (currently ongoing) I don't believe there is an issue with this person asking this question, I just wanted everyone to know. – Sievert Dec 6 '19 at 16:54
9

There's no file hidden in sector 2047. There may be data, but it's not part of the file system.

To recover it:

  1. Figure out sector size of disk
  2. Read sector with e.g. dd

Figure out sector size

sudo fdisk -l will show you sector sizes:

$ sudo fdisk -l
[sudo] password for root: 
Disk /dev/sda: 238.5 GiB, 256060514304 bytes, 500118192 sectors
Disk model: SAMSUNG MZ7TY256
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt

Here we have 512B sectors. This is probably the most common; some newer devices will have 4KB sector sizes. This is the reason we need to know the sector size of the device - we have to specify it in the next step, so dd knows how many bytes to skip.

Read out said sector

This dd can do for us.

sudo dd if=/dev/sda of=sector2047 bs=512 skip=2046 count=1
  • if=/dev/sda tells dd to read from /dev/sda
  • of=sector2047 tells dd to write to the file sector2047
  • bs=512 tells dd to read in 512B increments (block size)
  • skip=2046 tells dd to skip first 2046 512B-blocks
  • count=1 tells dd to read 1 block of 512B.
  • 1
    You can also pick up the sector size using either blockdev --getbsz /dev/sda or cat /sys/block/sda/queue/physical_block_size. – doneal24 Dec 6 '19 at 17:43
2

I would use the same command vidarlo used, but change the skip=2046 to skip=2047 and the count=1 to count=3. This will give a bigger space to search in.

Then do sudo apt install hexedit. After that, do hexedit sector2047 and scroll down until you see your message on the left.

  • This works, the poster should accept the answer. – Sievert Dec 6 '19 at 17:30
  • 1
    If count=3 don't you want skip=2045? Also it is best to post full command rather than 2 of the arguments only. – WinEunuuchs2Unix Dec 6 '19 at 18:14
  • 1
    The question asked for a very specific block, not three blocks, nor what to do with the information - and I explained the syntax rather well, so modifications should be trivial :) – vidarlo Dec 6 '19 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.