Forensic Imaging

Walkthrough summary

Forensic Imaging TryHackMe walkthrough with 6 answered prompts and lab methodology notes.

Sample prompts covered

• What command can be used to list all block devices in Linux OS?
  Open the walkthrough page to inspect the full answer and command flow.
• Which bash command displays all commands executed in a session?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the MD5 hash of the image "exercise.img" located in /home/analyst/?
  Open the walkthrough page to inspect the full answer and command flow.
• Mount the image "exercise.img" located in the analyst home directory folder. What is the content of the file "flag.txt" located within exercise.img?
  Open the walkthrough page to inspect the full answer and command flow.
• Create an image of the attached 1gb loop device. What is the MD5 hash of the image?
  Open the walkthrough page to inspect the full answer and command flow.