Episode 1 of retrying challenges attempted on my dead laptop : File Recovery using photorec and testdisk

warning: super informal, not professional, mostly unfiltered. apologies.)

Challenge 1 : using photorec and scalpel to retrieve files from a dd file (I also used sth else but I don't remember what)

(TESTDISK IT WAS TESTDISK)

(again for screenshots etc find on github)  https://github.com/dakshita-joshi/BlueTeamLabsOnline/blob/main/FileCarving

(Challenge was Employee of the Year completed on Jun 29 2022)

alright I remember I first used photorec and scalpel. i could restore the gifs and videos and answered most questions but the last question was hard because scalpel and photorec do not give original names but only rename the files on their own. to restore original names I had to use testdisk. now let me download again and try again god if only I had a time machine I had a whole play by play written down. nvm. let bygonz be bygonz.

alright got flag1 straight up and flag 2 on the word doc. i remember struggling very much with the word doc but I don't remember why. for some reason I read up the report XML and it mentioned the word doc but I simply couldn't see it and then?? I'm sorry I don't remember how I finally did get the word doc.

no 1 step I always followed (and still follow sometimes was to explore metadata for every img/mpeg4/pdf/doc I received. i don't remember it being much help in this challenge but I've seen it is a huge help a lot of times. 

oh no what an example to give because just to test I put the pdf in metadata2go and guess what flag 3 was in the author tag :|

right. testdisk shows intel partition type and if I'm right the original filename was here. that's how the final question was answered. let me see. 

ok testdisk isn't as intuitive as the other two. how come? i don't remember having issues with this. hold up, I did watch a video to help with testdisk recovery let me find it again.  sudo testdisk recoverfiles.dd. OK found it went to create log then selected the dd file then advanced then list and found all the original names which were, in order-

vanilla.gif

SBTCertifications.mp4

Flag3.pdf

Flag2.docx

Flag1.png

Right! Thats all Folks!