Disk forensics techniques are used to acquire the disk image, process this image to find artifacts of interest including deleted ones. 

In this lab, a disk image file “evidence.img” is provided in the home directory of the root user (/root/). There is a file on this image which contains the email and phone number of “evil” user. The email of the user is “evil@attacker.co.uk” and the phone number is the flag for this lab.

Objective: Extract the files from the disk image using the bulk extractor tool and retrieve the flag!

The solution for this lab can be found in the following manual: https://assets.ine.com/labs/ad-manuals/walkthrough-1793.pdf