4

I'm currently trying to find a file that was hidden in sector 2047. My root partition starts at sector 2048.
How would I go about finding that file? Given the only info I have is the sector its in.
Thanks in advance!

1
  • 7
    Just so everyone knows, this question is a forensics question in the cyberpatriot competition state round in the year 2019 (currently ongoing) I don't believe there is an issue with this person asking this question, I just wanted everyone to know.
    – Sievert
    Dec 6, 2019 at 16:54

2 Answers 2

9

There's no file hidden in sector 2047. There may be data, but it's not part of the file system.

To recover it:

  1. Figure out sector size of disk
  2. Read sector with e.g. dd

Figure out sector size

sudo fdisk -l will show you sector sizes:

$ sudo fdisk -l
[sudo] password for root: 
Disk /dev/sda: 238.5 GiB, 256060514304 bytes, 500118192 sectors
Disk model: SAMSUNG MZ7TY256
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt

Here we have 512B sectors. This is probably the most common; some newer devices will have 4KB sector sizes. This is the reason we need to know the sector size of the device - we have to specify it in the next step, so dd knows how many bytes to skip.

Read out said sector

This dd can do for us.

sudo dd if=/dev/sda of=sector2047 bs=512 skip=2046 count=1
  • if=/dev/sda tells dd to read from /dev/sda
  • of=sector2047 tells dd to write to the file sector2047
  • bs=512 tells dd to read in 512B increments (block size)
  • skip=2046 tells dd to skip first 2046 512B-blocks
  • count=1 tells dd to read 1 block of 512B.
1
  • 1
    You can also pick up the sector size using either blockdev --getbsz /dev/sda or cat /sys/block/sda/queue/physical_block_size.
    – doneal24
    Dec 6, 2019 at 17:43
2

I would use the same command vidarlo used, but change the skip=2046 to skip=2047 and the count=1 to count=3. This will give a bigger space to search in.

Then do sudo apt install hexedit. After that, do hexedit sector2047 and scroll down until you see your message on the left.

3
  • This works, the poster should accept the answer.
    – Sievert
    Dec 6, 2019 at 17:30
  • 1
    If count=3 don't you want skip=2045? Also it is best to post full command rather than 2 of the arguments only. Dec 6, 2019 at 18:14
  • 1
    The question asked for a very specific block, not three blocks, nor what to do with the information - and I explained the syntax rather well, so modifications should be trivial :)
    – vidarlo
    Dec 6, 2019 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .