[TWCTF-2016: Web] Rescue Data 1: deadnas Writeup


Challenge description:

Today, our 3-disk NAS has failed. Please recover flag.

We are given an archive containing 3 files:

D:\Megabeets\deadnas> dir 
Directory of D:\Megabeets\deadnas
524,288 disk0
     12 disk1
524,288 disk2

3 Disk NAS and one has failed? This challenge is obviously about RAID 5. I was asked to find a way to recover the failed disk and there is no simpler way than just XOR disk0 with disk2 and recreate the original disk1. If you are right now in your “WTF?!” mode you better go read about RAID 5 until you understand how it works.

I used simple software called XorFiles.


I then used OSForensics to rebuild the RAID:


Mounted the output file:


And accessed the new drive. The flag and a cute cat was waiting for me there.


* I know you tried using mdadm and ReclaiMe. Poor you.


One thought on “[TWCTF-2016: Web] Rescue Data 1: deadnas Writeup

Leave a Reply

Your email address will not be published. Required fields are marked *