# Disk, Disk, Sleuth! (110 + 130)

### DDS 1

`srch_strings dds1-alpine.flag.img | grep picoCTF`

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-154060252b8055fd3e6729ec997bbcbe265b895f%2F8d92d92e244a478eb9860bef29412bc6.png?alt=media)

### DDS 2

Note that our Linux partition offset is 2048. We will need to specify this in the `-o 2048` option subsequently.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-cb9764ae9673dda928e2e99bbb0674135bd8ad81%2F3f2d64f62fb6454eb5906fec56ccf62a.png?alt=media)

Find the location of the file:

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-236c91dc82368ba9ca6972a176e4b9d30236d36a%2Ff359b28b11a74547bb13b1665ec83bba.png?alt=media)

Recover the files:

`tsk_recover -e -o 2048 dds2-alpine.flag.img extracted`

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-a835a5ac299610cdea22141df2c5347296902717%2F346fe11a22db4eba82235a2c0fe836b3.png?alt=media)

Then navigate to the location (`root/down-at-the-bottom.txt`) found previously. Our flag is there.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-3ae62ec04492ae788af3ffc769bbf6194beff59e%2Fde8ba81541734fc5b7f59b78c855665f.png?alt=media)