Ext4 Inode Carving

Category: FORENSICS · Difficulty: Advanced · Points: 500 · Challenge: 491

Background

Adversaries executed an unlinking routine across a Linux database server to prevent incident analysis. Given a raw unallocated disk partition slice, trace the unlinked inode structures and reconstruct the cleared records. FORMAT: FLAG{ }

Analysis

The evidence file is 590 bytes and carries a generator marker followed by a single configuration line. Reading printable runs across the file recovers the value directly:

$ strings -n 8 evidence-049.raw
[FORENSIC_TRIAGE_TARGET_049]
CONFIDENTIAL_FLAG=FLAG{cwa2026_e00e49f19c972f9a}

The file holds no filesystem image, no archive structure and no encoded payload beyond the plaintext line above, so the inode parsing work described in the brief was not required. An ext4 superblock, block group descriptor table and inode bitmap were all absent, so no unlinked inode structures existed to trace.

Result

FLAG{cwa2026_e00e49f19c972f9a}