[CTF] WU - Incomplete File

Difficulty Level : Easy

Challenge Category : Forensics

Description :

A corrupted ZIP file has been found. It appears to be missing some of its data, but perhaps it's still possible to recover what it contains. Can you restore the archive and discover the flag?

Solution Steps

Step 1: Analyze the Corrupted File

• The given file is named truncated.zip, but it is damaged and cannot be directly extracted.

Command to Confirm:

unzip truncated.zip

Expected Result:

• The extraction fails with an error indicating that the file is incomplete or corrupted.

Step 2: Attempt to Repair the ZIP File

Use the zip utility to repair the corrupted archive. The -FF (fix fixable) option attempts to reconstruct the file.

Command:

zip -FF truncated.zip --out repaired.zip

Explanation:

• -FF: Attempts to fix the broken or truncated archive.
• --out repaired.zip: Outputs the repaired file as repaired.zip.

Expected Result:

• A new file, repaired.zip, is created.

Step 3: Extract the Repaired Archive

Extract the repaired ZIP file to recover its contents.

Command:

unzip repaired.zip

Expected Result:

• The extraction succeeds, revealing the contents of the archive, including a flag.txt file.