Link: (only for logged in users)
Points: 50
Category: forensic, warmup


Today, our 3-disk NAS has failed. Please recover flag.

Hint 1: The NAS used RAID.
Hint 2: RAID-5


From above output we know that disk1 is missing. We also know that RAID was used. The most probable version of RAID allowing 1 out of 3 disk loss is the one where every disk can be obtained by XOR-ing 2 other disks. We XOR-ed disk0 and disk2 to get disk1 using some python:
Now, to get the full NAS content, we had to determine the block distribution (the second hint had not been revealed yet). After few minutes of analyzing the disks content and with some knowledge of FAT12 structure) we have determined that parity block (BP) is on different disk in each row so we have distribution:
Simple python code to piece together all data blocks:
Now to check the content we can mount the resulting disk image:

Leave a Reply