Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a .dd file and the hint says Some files have been deleted from the disk image, but are they really gone? I have no clue what to do with it. Any help on how to proceed. I mean what should I start with? what could be the way I can find a flag? how to open this .dd file?

closed as too broad by Megabeets, perror, NirIzr, usr2564301, julian Oct 5 '18 at 23:51

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What tools are you using to analyze the file? What have you tried up to this point? – julian Oct 1 '18 at 14:22

From my experience, file extensions are rarely meaningful. To really understand what format you are playing with, I suggest you to try the linux file command on this file. It will (maybe) give you more insight on what you are working with.

I never did picoCTF but I bet the .dd refers to a raw disk image.

Now I have only a few experience in Forensics (yes I think it's more Forensics than Reverse Engineering per say), but I think you could try testdisk and/or PhotoRec (A tool that is shipped with testdisk). This software allows you to browse hard drive partitions and play a bit with it. Note that because it is a raw disk image, and if the partitions are not encrypted, using common/simple tools such as strings might reveal some interesting information.

I hope this will be helpful.


These are drive image files. You load them into a tool for forensic analysis like FTK Imager or EnCase in order to analyze the file system structure and recover some clues. If it's just the deleted file recovery that you need, use Testdisk / PhotoRec as said above.


It's hard to answer such a question without taking a look at the file itself, especially for extensions that don't have a clear and common use case; However, I would guess the extension is in reference to the dd unix command line utility that is used to read and write raw data from different sources and to different destinations. It's often how you'd take a dump of a block or a character device and save it as a file, for example.

Not the answer you're looking for? Browse other questions tagged or ask your own question.