RECOVERING FILES with Autopsy (PicoCTF 2022 #47 'operation-oni')

Поделиться
HTML-код
  • Опубликовано: 20 ноя 2024

Комментарии • 44

  • @MrToast72
    @MrToast72 2 года назад +3

    Briefly talks about Chmod three digit codes "you can look up resources on how this exactly works" then proceeds to explain how it exactly works lol thank you John, I love when you do that!

  • @BarYamin
    @BarYamin 2 года назад +7

    If you want to understand the rwx permission set, it's better to interpret it as binary.
    Basically, we have 3 bits that each represent r, w, and x, respectively.
    so, let's say I want read & execute, this translates to r-x, which translates in binary to 101, which then in turn converts to 4+1=5 in base10 :)

  • @SESUAV
    @SESUAV 2 года назад +6

    I used binwalk too. It was quick and easy using that than autopsy because of command line

  • @maxxinev.pennelope7179
    @maxxinev.pennelope7179 2 года назад

    Watching this on the TV cast with my father fingers crossed 🤞 it's not to over my or rather our head(s).

  • @testentry353
    @testentry353 2 года назад +6

    one easy way to remember the file permissions is to know that read is 4, write is 2, and execute is 1
    so r-x will be
    4+1=5
    and rw- will be
    4+2=6

    • @ericbarlow6772
      @ericbarlow6772 2 года назад

      It’s binary. RWX is a bit either on (1) or off (0). Read only is 100 in binary or 0*2^0 + 0*2^1 + 1*2^2 = 4.

    • @abiolasamuel9760
      @abiolasamuel9760 Год назад

      Hello 👋
      My samsung a71 phone was factory reset remotely and I don't have any backup whatsoever, is it possible to recover the phone data

  • @viv_2489
    @viv_2489 2 года назад

    Really like the alternate solution / additional extra curricular activity that you mention as applicable....

  • @TheNobleSavage612
    @TheNobleSavage612 2 года назад +21

    "i need to look for keys" hovers over the key folder and moves on

  • @wisemasterbuilder
    @wisemasterbuilder 2 года назад +1

    Love this Format Mighty Friend!
    You can lead a horse to water
    but ya can't always git'em to drink.

  • @IAmCandal
    @IAmCandal 2 года назад

    HOLY SHIT BRO YOU DONT EVEN KNOW HOW HELPFUL THIS WAS FOR ME HOMIE

  • @omaralhalboosi2713
    @omaralhalboosi2713 2 года назад

    Great great video John, but dude you are like sonic speed lol barely catching up , which made this vid a 40 minutes show. But the point is this is great . May God bless you brother

  • @fjr2go
    @fjr2go 2 года назад

    I like the 'short' informative videos like these. Thanks

  • @debarghyamaitra
    @debarghyamaitra 2 года назад +1

    I did it with commands icat and fls....it was a lot hectic though!

  • @rationalbushcraft
    @rationalbushcraft 2 года назад

    I like using autopsy and we don't even do traditional forensics as my state requires you be a PI of all things to do that. But I do use it for data recovery and I even use a hardware write blocker. Probably seems like overkill but I never have to say that I may have changed something so if the end user wants to send it to Ontrack or some other place I can argue that we never changed anything.

    • @abiolasamuel9760
      @abiolasamuel9760 Год назад

      Hello 👋
      My phone was factory reset remotely and I don't have any backup whatsoever, is it possible to recover my phone data

  • @eavi4645
    @eavi4645 2 года назад

    Great video, love the content. Thank you!

  • @booruledie3052
    @booruledie3052 2 года назад

    cant wait for htb cyber apocalypse videos.

  • @hallgowrt
    @hallgowrt 2 года назад

    the audio seemed low
    at full volume was I able to hear anything
    as always great vid

  • @jreamscape
    @jreamscape 9 месяцев назад

    thanks dude

  • @Zerback
    @Zerback 2 года назад

    Great content John! Keep it up!

  • @Lacsap3366
    @Lacsap3366 2 года назад

    Lol I just mounted the root partition as a loop device with losetup

  • @zer001
    @zer001 2 года назад

    Nice one as allways!

  • @bech2342
    @bech2342 2 года назад

    uh, he saw for the first time a kernel source tree 🙊
    binwalk FTW!

  • @johnmcmanus6719
    @johnmcmanus6719 2 года назад +1

    The SSH key wasn't a deleted file though

  • @yaserbasaad7984
    @yaserbasaad7984 2 года назад

    You are Epic

  • @CA-FE-C0-FF-EE-00
    @CA-FE-C0-FF-EE-00 2 года назад

    Watching this file failing the htb CTF xD only 8 challenges done, but I'm alone ^^

  • @ecjb1969
    @ecjb1969 2 года назад

    Couldn’t you just midair image; mount -t iso9660 -o loop disk.img image to mount the disk image and then use find to look for SSH keys and the like?

  • @luthfisukma9787
    @luthfisukma9787 2 года назад +1

    are you use linux for daily driver ??

  • @Youtupe69
    @Youtupe69 2 года назад +1

    Whats this GUI, I've used autopsy on windows and it wasnt a web app, had a much nicer GUI... Is it not available on Linux?

    • @kiyu3229
      @kiyu3229 Год назад

      It is you can install it with apt

  • @msasdc2087
    @msasdc2087 2 года назад

    Finnaly, I got your home address.

  • @re70-december32
    @re70-december32 2 года назад +1

    Hiiiii

  • @guilherme5094
    @guilherme5094 2 года назад

    👍

  • @shocker9434
    @shocker9434 2 года назад

    13:40 whats that finish command 🤔🤔 can anyone explain?

    • @PR1NC3
      @PR1NC3 2 года назад +1

      he created bash script to rename the working folder with prifix _completed

    • @shocker9434
      @shocker9434 2 года назад +1

      @@PR1NC3 oh got it. thanks

  • @johny_dope8575
    @johny_dope8575 2 года назад +2

    1

  • @herrpez
    @herrpez 2 года назад

    I love your content, but calling things a "gimmick" when they're far from it... that's... grating. :(

    • @abiolasamuel9760
      @abiolasamuel9760 Год назад

      Hello 👋
      My phone was factory reset remotely and I don't have any backup whatsoever, is it possible to recover my phone data

    • @abiolasamuel9760
      @abiolasamuel9760 Год назад

      Hello 👋
      My phone was factory reset remotely and I don't have any backup whatsoever, is it possible to recover my phone data