PICOCTF 2026 • FORENSICS • DISK PARTITIONING & GIT CARVING

Forensics Git 0: Linux Disk Partitioning & Inode Git Carving

By Abdo•6 min read•PicoCTF 2026
TARGET IMAGEdisk.img (1 GB)
SECTOR OFFSET1140736 (Root ext4)
TARGET INODE65693 (COMMIT_EDITMSG)
FLAGpicoCTF{g17_1n...}
Linux Disk Partitioning and Git Inode Carving
FIGURE 1: Digital Forensics Workbench & Disk Sector MappingThe Sleuth Kit • mmls • fls • icat
Forensic Scenario

We are given a raw 1 GB hard drive image (disk.img). Unlike raw single partitions, attempting to run filesystem tools directly fails with Cannot determine file system type because Sector 0 holds an MBR partition table. Using The Sleuth Kit, we map out the partition sectors using mmls, jump directly to the Linux root filesystem via sector offset 1140736, locate an embedded Git repository in the user space, and carve out the flag from the Git commit metadata.

01. Mapping Partitions with mmls

To determine where the Linux filesystem starts on the 1 GB physical disk image, we inspect the partition table using mmls:

POWERSHELL • LIST PARTITIONS
mmls.exe .\disk.img
// MBR Partition Layout:
DOS Partition Table (Units in 512-byte sectors)
Slot 002 (Start 0000002048, Length 0000614400): Linux (Boot)
Slot 003 (Start 0000616448, Length 0000524288): Linux Swap
Slot 004 (Start 0001140736, Length 0000956416): Linux (Root ext4)

The primary root filesystem starts at Sector 1140736 ($1,140,736 \times 512 = 584,056,832$ bytes). We supply this value with the -o 1140736 switch in all subsequent commands.

02. Traversing User Space with fls

First, we verify the root directories to find the Inode of /home:

POWERSHELL • VIEW ROOT INODES
fls.exe -o 1140736 .\disk.img

/home maps to Inode 64770. We recursively query inside Inode 64770:

POWERSHELL • RECURSIVE HOME TRAVERSAL
fls.exe -o 1140736 -r .\disk.img 64770
// Discovered Git Repository Structure:
/home/ctf-player/Code/secrets/
├── .git/
│ ├── COMMIT_EDITMSG (Inode 65693)
│ └── logs/HEAD (Inode 65704)
└── note.txt (Inode 65692)

03. Inode Carving with icat

Using Sleuth Kit's icat, we carve raw file data directly by Inode without mounting:

1. Reading note.txt (Inode 65692):
icat.exe -o 1140736 .\disk.img 65692
// Output: The picoCTF flag format is 'picoCTF{}' where there is some leetspeak phrase in between the curly braces
2. Reading COMMIT_EDITMSG (Inode 65693):
icat.exe -o 1140736 .\disk.img 65693
// Output: Wrap this phrase in the flag format: g17_1n_7h3_d15k_041217d8
3. Verifying with Git Reflog (Inode 65704):
icat.exe -o 1140736 .\disk.img 65704
// Reflog Record:
... commit (initial): Wrap this phrase in the flag format: g17_1n_7h3_d15k_041217d8
OFFICIAL CAPTURED FLAGpicoCTF{g17_1n_7h3_d15k_041217d8}