Defcon 18 CTF quals writeup - Forensics 100

Forensics 100 was simple forensics but still with some traps.

Description: find the key, and they gave us the following file which revealed to be a gzipped raw disk image.

First analysis

After extracting, use the file command to recognize a raw disk image:

$ file f100_6db079ca91c4860f.bin
f100_6db079ca91c4860f.bin:    x86 boot sector; partition 1: ID=0x7, starthead 0,
  startsector 31, 31558 sectors

Write-up Codegate 2010 #19 - Forensic, introduction to the Sleuth Kit and Autopsy

Challenge #19 was also interesting, at least for the story:

Found a dead guy on the street, assumed that a guy committed suicide.
How can you assume that? Find the clue.

And they gave us a simple binary file: 56DACF1C6CF363F27501FFCA50CC0415 (9.6MB).