Retro Recovery

Difficulty:
Area: Retro shop
In-game avatar: Mark DeVito

Hints

Retro Recovery Hint 1

I know there are still tools available that can help you find deleted files. Maybe that might help. Ya know, one of my favorite games was a Quick Basic game called Star Trek.

Retro Recovery Hint 2

Wow! A disk from the 1980s! I remember delivering those computer disks to the good boys and girls. Games were their favorite, but they weren't like they are now.

Retro Recovery Hint 3

I miss old school games. I wonder if there is anything on this disk? I remember, when kids would accidentlly delete things.......... it wasn't to hard to recover files. I wonder if you can still mount these disks?

Objective

Request

Join Mark in the retro shop. Analyze his disk image for a blast from the retro past and recover some classic treasures.

Mark DeVito

I am an avid collector of things of the past. I love old technology. I love how it connects us to the past. Some remind me of my dad, who was an engineer on the Apollo 11 mission and helped develop the rendezvous and altimeter radar on the space craft.

If you ever get into collecting things like vintage computers, here is a tip. Never forget to remove the RIFA capacitors from vintage computer power supplies when restoring a system. If not they can pop and fill the room with nasty smoke.

I love vintage computing, it's the very core of where and when it all began. I still enjoy writing programs in BASIC and have started re-learning Apple II assembly language. I started writing code in 1982 on a Commodore CBM.

Sometimes it is the people no one can imagine anything of who do the things no one can imagine. - Alan Turing

You never forget your first 8-bit system.

Item

We get a floppy from when we talk to Mark.

High-Level Steps

1. Explore – Mount and inspect the disk image.
2. Recover – Restore deleted files from the image.
3. Decode – Decode the recovered data to reveal the message.

flowchart TD

  subgraph Row1["Explore"]
    direction LR
    A[Mount disk image]
    B[List file contents]
    A --> B
  end

  subgraph Row2["Recover"]
    direction LR
    C[Scan for deleted files]
    D[Recover file with TestDisk]
    C --> D
  end

  subgraph Row3["Decode"]
    direction LR
    E[Inspect recovered file]
    F[Decode embedded data]
    G[Objective completed]
    E --> F --> G
  end

  Row1 --> Row2
  Row2 --> Row3

Solution

We mount the image to explore the files in it.

sudo mount -o loop -t vfat floppy.img /mnt/img
ls /mnt/img -lR

Explore deleted files with TestDisk. Select proceed

sudo testdisk floppy.img

Select None

Select Undelete

Press c to copy the current file

Press C to copy to the selected destination

Press c to copy the current file
Press q

Select “Quit” and hit enter.

Select Quit and hit enter.

Select the correct disk (floppy.img)
Select Quit and hit enter to quit the program

The file is recovered.

Just read the .bas file and we notice a string which looks like base64 encoded string.

cat all_i-want_for_christmas.bas

Decoding that base64 shows below "merry christmas to all and to all a good night" We see if this is accepted as the answer and It was!

echo "bWVycnkgY2hyaXN0bWFzIHRvIGFsbCBhbmQgdG8gYWxsIGEgZ29vZCBuaWdodAo=" | base64 -d

Answer

merry christmas to all and to all a good night

Response

Mark DeVito

Excellent work! You've successfully recovered that deleted file and decoded the hidden message.
Sometimes the old ways are the best ways. Vintage file systems never truly forget what they've seen. Play some Star Trek... it actually works.

Learnings

Learnt about TestDisk and how to recover data from the floppy disk.

Prevention & Hardening Notes

When handling legacy systems or backups, If they are really decommissioned, securely wipe them. In this case, I would format the floppy disk.