{
    "id": "f658c2db-de9f-3462-9209-cdacb4e6612a",
    "name": "File Carving (Scalpel)",
    "slug": "file-carving-scalpel",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "d150787c-c042-4e29-86ba-3e6312597ffa",
            "8d8f1728-bbf5-30ec-9e35-82b748bf966a"
        ],
        "pta_sdn": "1792",
        "pta_namespace": "attackdefenselabs",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-03-17T11:44:17.771123Z",
    "modified": "2023-12-08T19:40:29.102191Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [
        {
            "id": "94b65232-279b-4f35-8754-80f47bbe42d3",
            "name": "Basics"
        },
        {
            "id": "fd38d8ac-242a-4c0d-8c3d-2191bddc6f20",
            "name": "Disk Forensics"
        }
    ],
    "tags": [],
    "difficulty": "novice",
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "external_url": "",
    "solution_video": "e252a2cb-6826-3ef9-8d2e-e5d15d263036",
    "explanation_video": null,
    "description": "Disk forensics techniques are used to acquire the disk image, process this image to find artifacts of interest including deleted ones.\u00a0\n\nIn this lab, a disk image file \u201cevidence.img\u201d is provided in the home directory of the root user (/root/). One of the PDF files present on the disk contains the flag.\n\n  \n**Objective:** Extract files from the given image using **[Scalpel](https://github.com/sleuthkit/scalpel)** tool and retrieve the flag!\n\n  \n\n\n  \n\n\nGuidelines:\n\n* pdftotext tool can be used to convert PDF files into text files.",
    "description_html": "<p>Disk forensics techniques are used to acquire the disk image, process this image to find artifacts of interest including deleted ones.\u00a0</p>\n<p>In this lab, a disk image file \u201cevidence.img\u201d is provided in the home directory of the root user (/root/). One of the PDF files present on the disk contains the flag.</p>\n<p><strong>Objective:</strong> Extract files from the given image using <strong><a href=\"https://github.com/sleuthkit/scalpel\">Scalpel</a></strong> tool and retrieve the flag!</p>\n<p>Guidelines:</p>\n<ul>\n<li>pdftotext tool can be used to convert PDF files into text files.</li>\n</ul>",
    "tasks": "",
    "tasks_html": "",
    "published_date": "2022-06-23T15:57:57Z",
    "solutions": "The solution for this lab can be found in the following manual:\n        <a href=\"https://assets.ine.com/labs/ad-manuals/walkthrough-1792.pdf\" target=\"blank\">https://assets.ine.com/labs/ad-manuals/walkthrough-1792.pdf</a>",
    "solutions_html": "<p>The solution for this lab can be found in the following manual:\n        <a href=\"https://assets.ine.com/labs/ad-manuals/walkthrough-1792.pdf\" target=\"blank\">https://assets.ine.com/labs/ad-manuals/walkthrough-1792.pdf</a></p>",
    "flags": [
        {
            "name": "Flag ",
            "type": "short-text",
            "uuid": "65bffcd7-328f-4610-92ad-b30a05ceb343"
        }
    ],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": {
        "id": "c3de86a5-32f0-4dbb-9511-a5a591515e52",
        "user_id": "5dde02c1-353c-4e44-af4d-e217c38efd6a",
        "lab": {
            "id": "ad7c1ba5-4f43-39d6-87fb-be25e6623608",
            "name": "XSS Attack with XSSer",
            "lab_type": "pta"
        },
        "pta_url": "https://jznfpnoy8i385wsg90w9sfzb8.us-east-4.attackdefensecloudlabs.com",
        "last_started_at": "2024-06-21T18:53:01.159725Z",
        "terminated_at": null,
        "running_time": 4917,
        "metadata": {
            "layout": "en-us-qwerty",
            "region": "US-East",
            "context": {
                "parent_id": "ec4e1013-09f0-486a-acea-ee4936e2cf7f",
                "parent_name": "Web Application Penetration Testing: Introduction to the Web and HTTP Protocol",
                "parent_type": "course"
            }
        },
        "status": "started",
        "created": "2024-06-21T18:53:01.159766Z",
        "modified": "2024-06-21T20:14:58.614741Z",
        "duration_in_seconds": 4911,
        "shutdown_time": 10800
    }
}