0

I'm actually trying to make my hand around forensic and information security as a whole. To do this, I'm trying to make a lot of CTFs. The last one I got to do is puzzling me, 1st because I have no experience with this and second, because I don't know how to manage data recovery.

To make things short: I got a USB dump (FAT16) which at first it looks about 1 Gb in size. I was able to recover some files from it already using autopsy and FTK Imager.

When I read the data contained in the usb drive with these softwares, I can see that there is about 900 Mb of ''unallocated space'' and when I try to look at it with the hex heditor, all bits are 0. I have 2 questions :

  1. Is this normal that those bits are all 0 on unallocated space?
  2. Is there anyway to recover the data that was there before it became unallocated?

I think this space could contain the flag I Ineed, but I can't seem to recover it. I've tried few things : Mount the drive on my computer with FTK and use tools to try to recover it, but none worked. I also tried to get a hint if there was lost data in all those 0's but I still hadn't had any luck.

From the recovered data in autopsy I have following files:

$FAT1
$FAT2
$MBR
$Unalloc --- this is the space that is of interest to me
.Folder
File1
File2

When I open $unalloc, I have a file in it which have a size, but all bits are set to 0 in the hexedit.

3

Unallocated space of all zeroes is common in a new or cleaned drive. A used drive will generally have left over fragments and deleted files.

Zeroes are zeroes, there is no recovering a previous value. When people speak of recovering files, they are referring to reconstructing actual data from the unallocated space. You apparently don't have any data to recover.

Concentrate your efforts on the data you do have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.