# The Sleuth Kit Intro

<div align="center"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fzlp57Azec4lUAU3lfEZe%2Fsleuth_kit2-678x381.png?alt=media&#x26;token=46f4023a-abc9-4ede-84db-7ca99e189ced" alt=""></div>

### 1. Introduction

> In this lab, a disk image file “**evidence.img**” is provided in the home directory of the root user (/root/). Interact with the image using [**The Sleuth Kit**](https://github.com/sleuthkit/sleuthkit) and answer the following questions:

1. What is the image format type of the image?
2. Which file system type is used in the image?
3. Which directory was mounted most recently from the disk whose image is provided to us?
4. List the names of the directories present on the image.
5. What is the name of the file present in the notes directory?
6. Retrieve the flag kept inside the flag.txt file.

### 2. Check image format type

Let's check first which filetypes are possible:

`img_stat -i list`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FCGK6Hz82cfPQOrZjjL2D%2Fsleuth_1.png?alt=media\&token=b831032f-729e-41e3-bc9f-e677459b2a3e)

Check image format type:

`img_stat -t evidence.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FQVl85hvEePDDzwEASDOX%2Fsleuth_2.png?alt=media\&token=18c5e245-7d6b-4a0f-9fac-74dea291d7c5)

Answer1:&#x20;

> It's the raw format

### 3. Check file system type

Let's check first which filesystem types are possible:\
\
`fsstat -i raw -f list`

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FUYL8keHUbaqnCVGP2IxT%2Fsleuth_3.png?alt=media&#x26;token=d07a4630-f81d-4c3d-831b-32064a830609" alt=""></div>

&#x20;Check Image file system type:

`fsstat -i raw -t evidence.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FU8OJFmmjvVVEZzpQgWY3%2Fsleuth_4.png?alt=media\&token=2c7ff337-38f2-4b3d-9341-98124bd8b777)

&#x20;Answer 2:

> It's the ext4 filesystem

### 4. Check mount directory

We can get more information about the filesystem with the following command:

`fsstat -i raw -f ext4 evidence.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FOYmYnhEojThvlmfqRL45%2Fsleuth_5.png?alt=media\&token=aadb0902-8ae5-45f3-944d-ba7af0e465b0)

&#x20;Answer 3:

> mount directory is /mnt/disk0

### 5. List directories from the image

To list the names of the directories we can use the following command:

`fls -i raw -f ext4 evidence.img`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FpXyaXWP0SJuUXKo1uEtr%2Fsleuth_6.png?alt=media\&token=f2cc7a07-58c3-4bd5-bdbb-6f9dc164e91f)

Answer 4:

> notes, photos, videos

### 6. Get the file name inside notes directory

To get the name of a specific file in the notes directory I use the following command:

`fls -i raw -f ext4 evidence.img`` `**`12`**

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FSgJGQQXqY8QVmWYarxV2%2Fsleuth_7.png?alt=media\&token=6183f73b-d8c8-4a09-9430-25526adacbd4)

Answer 5:

> flag.txt

### 7. Retrieve the flag

Now I need to find a way to see what’s stored inside the file flag.txt

`icat -i raw -f ext4 evidence.img`` `**`16`**` ``>flag.txt`

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FYbqXTDELhSGaRKe3estt%2Fsleuth_8-1024x238.png?alt=media\&token=6945e11b-9b8c-4906-883c-03ee7c8e5431)

&#x20;Answer 6:

> baa82c37e53e2886a8a1379f4e3c2999

### 8. Summary

{% embed url="https://vimeo.com/676401674" %}

