Filesystem Investigation Lab

Linux FoundationsLab 1 of 245–60 minutesLab included

You have learned how to move through the Linux filesystem and inspect a file without trusting its name. Now we are going to use those skills on a small investigation.

This is a guided lab. The commands are provided, but the conclusion is not. Your job is to collect the evidence, explain what it means, and use it to construct a flag.

Hands-on lab

Mission

Five files have misleading names. Determine what each file actually is, record the evidence that supports your answer, and use your results to construct the lab flag.

Before you begin

Complete What Is Linux? and Navigating the Linux Filesystem before starting. You will use pwd, ls, cd, file, and stat here.

The supplied directory is the entire scope of this investigation. Work only inside the course VM, do not test public or third-party systems, and do not modify the supplied files. Nothing outside this little pile of suspiciously named files is part of the lab.

Get the lab artifact

Download filesystem-investigation-v1.0.0.tar inside your course VM. Your browser will normally place it in Downloads.

This lesson uses version 1.0.0. Its expected SHA-256 hash is:

437fa0cf724dfb09804e3987d4d970451d361b24d40cfc202871e6db2829a87b

Open a terminal, move to Downloads, and confirm that the archive is present:

cd ~/Downloads
pwd
ls -l filesystem-investigation-v1.0.0.tar

Then calculate its hash:

sha256sum filesystem-investigation-v1.0.0.tar

Compare the long string at the beginning of the output with the expected hash above. They must match exactly. A matching hash tells us that the file contains the same bytes as the artifact used to build this lesson.

Safety note

Stop if the hash does not match

Delete that download using the Files application, download it again, and repeat the check. If it still does not match, report the problem rather than trying to repair the archive.

Extract a working copy

An archive packages a collection of files into one file. Create a directory for this lab and extract the archive into it:

mkdir -p ~/underdunn-labs/filesystem-investigation
tar -xf filesystem-investigation-v1.0.0.tar -C ~/underdunn-labs/filesystem-investigation

Here, tar works with the archive, -x means extract, -f says the next argument names the archive, and -C selects the destination directory.

Move into the extracted directory and confirm where you are:

cd ~/underdunn-labs/filesystem-investigation/filesystem-investigation-v1.0.0
pwd
ls -la

You should see START-HERE.txt and a directory named casefiles. Read the supplied instructions:

cat START-HERE.txt

cat prints a text file in the terminal. We are using it on the known text instructions, not blindly opening each unknown file.

Build an evidence log

Move into the case directory:

cd casefiles
pwd
ls -la

Do not skip -a. One entry begins with a period and will not appear in an ordinary ls listing.

Create an evidence log in your notes. Use these rows in this exact order:

Filename	Output from file	Useful metadata from stat	Your conclusion
.maintenance
backup.tar
briefing.txt
diagram.png
records.csv

For each file, run both inspection commands:

file .maintenance
stat .maintenance

file backup.tar
stat backup.tar

file briefing.txt
stat briefing.txt

file diagram.png
stat diagram.png

file records.csv
stat records.csv

Copy the relevant output into your log. In the final column, state what you think the file is and point to the observation supporting that conclusion. “It ends in .png” is a claim based on a label. “The file command identified PNG image data” is a conclusion supported by observed content.

Checkpoint

Compare the names with the evidence

Before moving on, answer these questions in your notes:

1. How many filename extensions accurately describe their files?
2. Which command gave you evidence about content?
3. Which command gave you size, ownership, permissions, and timestamps?

If your conclusions are still based on filenames, return to the file output.

Construct the flag

The flag records the real file types in the same order as the evidence table. Convert the leading type reported by file into these canonical tokens:

If file identifies…	Use this token
ASCII text	ascii
gzip compressed data	gzip
PNG image data	png
PDF document	pdf
Zip archive data	zip

Join your five observed tokens with underscores and place them inside the standard wrapper:

UNDERDUNN{first_second_third_fourth_fifth}

Use lowercase tokens and preserve the filename order from the evidence table. Do not order the tokens alphabetically or by the sequence in which you happened to run commands.

Check your answer

The expected SHA-256 hash of the correct flag is:

1321cb28c5ce8cd21457b51d8cab762e2f687e1372c59799c3747b0ab8488a7d

Replace the example text with your constructed flag and calculate its hash:

printf '%s' 'UNDERDUNN{your_constructed_flag}' | sha256sum

printf '%s' sends the flag to sha256sum without adding a hidden newline. Even one extra character produces a completely different hash.

If the output matches the expected hash, the flag is correct. Otherwise, check capitalization, braces, underscores, and token order before collecting the evidence again.

Hint 1: I cannot find five files

Run ls -la. Linux normally hides names that begin with a period.

Hint 2: The extensions and contents disagree

That is intentional. Use the result from file, not the extension, as evidence of the content type.

Hint 3: My types look correct, but the hash does not match

Use the exact filename order in the evidence table. Translate the beginning of each file result with the canonical-token table, then join the tokens with underscores.

Finish the investigation

Your lab is complete when you have:

• verified the artifact hash;
• accounted for all five files, including the hidden one;
• recorded output from both file and stat;
• written conclusions that cite observed evidence; and
• produced a flag whose hash matches the expected answer.

Add two short answers to your evidence log:

1. Why is a filename extension insufficient evidence of a file’s contents?
2. If you received another unfamiliar directory tomorrow, what would you inspect before opening anything?

Reset or clean up

To repeat the lab, open Ubuntu’s Files application and browse to:

Home/underdunn-labs/filesystem-investigation

Delete only the extracted filesystem-investigation-v1.0.0 directory. Keep the downloaded .tar archive, verify its hash again, and repeat the extraction steps.

When you are finished for good, use Files to remove that same extracted directory and, if you no longer want it, the archive in Downloads. We have not introduced recursive deletion commands yet. This lab is a poor reason to learn one by guessing.