Have you ever found a file system dump and asked yourself how you should read it? Look no further! In this workshop, you will gain hands-on experience based on a real-life example of a file system that you probably have somewhere, but never looked at.

Please bring a laptop and have a handful of tools installed:

• a hex viewer such as ImHex, xxd, hexdump, hd, hexedit or whatever you prefer
• a setup to write a little program in your favourite language (I suggest Rust or Python, but it's up to you)
• a web browser to download a file 🤫

You will learn how to spot patterns in a file system dump, how to recognize some basic data structures, and how to write a little parser to further understand them, until you end up with a tool to extract actual files.