---
# System prepended metadata

title: Sleuthkit Intro
tags: [picoCTF]

---

1. Use `gunzip -d` to extract the file
```shell
┌──(kali㉿kali)-[~/code]
└─$ gunzip -d disk.img.gz
                   
```
2. The description says that we should *use `mmls` on it to find the size of the Linux partition*, so I look up for the [instructions of `mmls`](https://www.kali.org/tools/sleuthkit/#mmls)
```shell
┌──(kali㉿kali)-[~/code]
└─$ mmls disk.img
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000204799   0000202752   Linux (0x83)
```
3. Paste the length of Linux (which is `0000202752`) to netcat
```shell
┌──(kali㉿kali)-[~]
└─$ nc saturn.picoctf.net 52472
What is the size of the Linux partition in the given disk image?
Length in sectors: 0000202752
0000202752
Great work!
picoCTF{mm15_f7w!}

```