Links

Disk, Disk, Sleuth! (110 + 130)

Disk image analysis

DDS 1

srch_strings dds1-alpine.flag.img | grep picoCTF

DDS 2

Note that our Linux partition offset is 2048. We will need to specify this in the -o 2048 option subsequently.
Find the location of the file:
Recover the files:
tsk_recover -e -o 2048 dds2-alpine.flag.img extracted
Then navigate to the location (root/down-at-the-bottom.txt) found previously. Our flag is there.