Challenge description:
Today, our 3-disk NAS has failed. Please recover flag.
deadnas.7z
We are given an archive containing 3 files:
D:\Megabeets\deadnas> dir Directory of D:\Megabeets\deadnas . .. 524,288 disk0 12 disk1 524,288 disk2
3 Disk NAS and one has failed? This challenge is obviously about RAID 5. I was asked to find a way to recover the failed disk and there is no simpler way than just XOR disk0 with disk2 and recreate the original disk1. If you are right now in your “WTF?!” mode you better go read about RAID 5 until you understand how it works.
I used simple software called XorFiles.
I then used OSForensics to rebuild the RAID:
Mounted the output file:
And accessed the new drive. The flag and a cute cat was waiting for me there.
* I know you tried using mdadm and ReclaiMe. Poor you.
Shit. Im using reclaime. -_-