EXT Analysis

Walkthrough summary

EXT Analysis TryHackMe walkthrough with 8 answered prompts and lab methodology notes.

Sample prompts covered

• What is the member of the ext4_super_block struct that holds the offset value to the first data block?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the offset where we can find the member s_blocks_count_lo in the ext4_super_block struct? (decimal format)
  Open the walkthrough page to inspect the full answer and command flow.
• What is the inode number for the file /etc/passwd in the VM?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the btime for the file /etc/passwd?
  Open the walkthrough page to inspect the full answer and command flow.
• Select Data Sources > ext4_case.img_1 Host > ext4_case.img and select the file normal_file.txt. Analyze the data in the File Metadata tab on the bottom pane. What is the inode number of the file?
  Open the walkthrough page to inspect the full answer and command flow.