Intergalactic Recovery - HackTheBox Challenge Writeup

Challenge Information

Challenge Description

Miyuki’s team stores all evidence from important cases in a shared RAID 5 disk. With case IMW-1337 nearly complete, the evidence and clues are critical. However, an electromagnetic pulse generated by Draeger’s EMP cannon has partially destroyed the disk array. Your task is to recover the content from the failed disk and help Miyuki’s team retrieve the lost data.

Challenge Analysis

This forensics challenge involves RAID 5 data recovery. RAID 5 uses striping with parity, meaning that data can be reconstructed even when one disk in the array fails. The EMP has damaged one of the disks, but the parity information should allow us to recover the missing data.

Solution Overview

The solution approach involves:

1. Understanding RAID 5 Architecture — Identifying how data and parity are distributed across disks
2. Analyzing the Disk Images — Examining the provided disk files to understand their structure
3. Recovering Data — Using RAID reconstruction techniques to recover the damaged disk’s contents
4. Extracting Evidence — Accessing the recovered data to find the flag

Key Steps

Step 1: Examine the Challenge Files

# List available files in the challenge directory
ls -la

# Check file sizes and types
file *
hexdump -C <disk_image> | head -20

Step 2: Identify RAID 5 Configuration

RAID 5 requires analyzing multiple disk images to understand:

• Stripe size (typically 4KB or 64KB blocks)
• Parity distribution pattern
• Which disk is damaged/missing

# Analyze disk structure
# Compare headers and block patterns across disk images
for disk in disk*; do
    echo "=== $disk ==="
    hexdump -C "$disk" | head -5
done

Step 3: Reconstruct Missing Data

Use RAID reconstruction logic or tools to recover the damaged disk:

# Using mdadm if available
sudo mdadm --create /dev/md0 --level=5 --raid-devices=3 \
    /dev/disk1 /dev/disk2 missing

# Or use Python/custom scripts to implement XOR recovery:
# parity = disk1_data XOR disk2_data XOR disk3_data
# missing_data = parity XOR disk1_data XOR disk2_data

Step 4: Mount and Extract

# Mount the recovered RAID array
sudo mount /dev/md0 /mnt/recovery

# Search for flag files
find /mnt/recovery -type f -name "*.txt" -o -name "*flag*"
cat /mnt/recovery/path/to/flag

Tools Used

• hexdump — Binary file analysis and hex inspection
• file — File type identification
• mdadm — RAID array management
• strings — Extract readable content from binary files
• Python — Custom RAID XOR reconstruction scripts

Key Learnings

1. RAID 5 Fundamentals — Understanding how parity allows single-disk failure recovery through XOR operations
2. Forensic Data Recovery — Techniques for reconstructing data from partial or damaged storage systems
3. Disk Image Analysis — Examining raw disk structures and recovering formatted data
4. Parity Computation — Using XOR mathematics to recover missing data blocks in striped arrays

Flag

HTB{<redacted>}

Note: The provided solve notes did not contain execution traces or specific findings. A complete solution would require access to the actual challenge files and their structure to implement proper RAID 5 reconstruction.