SU-CTF-2014 Qualifications — Recover Deleted File

first list files in decompressed disk image:

fls disk-image

output:

d/d 11:    lost+found
r/r * 12:    flag
d/d 257:    $OrphanFiles

* means it is deleted so we note inode number of flag to recover it and find its full path:

ffind disk-image 12

output:

* /flag

then we can undelete it using extundelete:

extundelete disk-image --restore-file /flag

flag file is an executable so we give it permissions and execute:

chmod +x flag; ./flag 

then we get:

your flag is:
de6838252f95d3b9e803b28df33b4baa