TYS 0x03 - I fatfinger deleted my cute little puppy!

This post is part of the Test Your Skills series. You can find an introduction here. And an overview of all TYS’s currently available is over here.


Bob, who has a very cute little puppy, sends you an email asking for your help. He says that he, by accident, deleted the best picture he had of his cute little puppy from a USB memory stick. He also mentioned that he immediately unplugged the memory stick once he noticed that he deleted the picture. He took an image of the stick with DD and attached it to the email.

His last line in the mail is something like: This is really important to me. I need this picture back asap. I will make up to you if you can deliver within 72 hours!


You heard Bob! Go ahead and figure out if there is a way to recover the picture of his little puppy from the stick image.
Keep in mind: Nothing is like it seems. There has to be a reason why Bob wants this picture back so badly and why it has to happen so quickly. I leave it to you what you make out of that!

Download the tys_0x03_usb-stick.img.xz and get crackin!

Have fun hunting, feel free to post your approach / write-up and let me know if you have any questions, feedback or general comments in the respective twitter thread over here:

Verify the files you download with:

md5sum     5979fc8dc67dfacc54065620cb478945                                  cdn/tys/tys_0x03_usb-stick.img.xz
sha1sum    90315623534165dfd40b8f6cfd1d608576a13bf6                          cdn/tys/tys_0x03_usb-stick.img.xz
sha256sum  433fb5a1f70e714eb1adeddfcc26f2cffe31f8908c8ece20afed90c59011f999  cdn/tys/tys_0x03_usb-stick.img.xz