Where It All Began · Huntress CTF 2026

The challenge

Only the prompt's key phrase was kept, not the full text: disk images, where the job is to "recover partition layouts, locate evidence by offset, prove which image was rebuilt from an incomplete source".

answer_id	Question	Format
`d28-disk-001-disk-partition-start-lba-sequence`	"Determine disk.partition_start_lba_sequence for disk-001.img."	json: a compact array

As on every Metadata day, the timed modes asked today's field together with every earlier day's fields; the Mastery had 12 sets. The timed question counts weren't recorded.

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"disk images"	Raw `.img` files with a partition table	First disk-image field of the event. Nothing pre-built covered it, so the solver sorted it as a new field
"recover partition layouts"	MBR and GPT tables	The new reader takes GPT entries when an `EFI PART` header is present, otherwise the MBR primaries plus any EBR chain
"locate evidence by offset"	Where each partition starts on the disk	The question asked for the start LBAs, in table order. The Single's only partition was named "HUNTRESS EVIDENCE"
"prove which image was rebuilt from an incomplete source"	Comparing images	No Single question asked for it, and no timed field for it was recorded
"Where It All Began" (title)	Where a partition begins: its first LBA	Confirmed the reading
"compact array" (format)	JSON with no spaces	Integers joined by commas, `[34]`

What was in the files

Single Solve: disk-001.img, 131,072 bytes (256 sectors of 512). A protective MBR with one 0xEE slot (start LBA 1, 255 sectors); the GPT header at LBA 1, with its entry array at LBA 2 (128 entries of 128 bytes); the backup header at LBA 255. One used entry: first LBA 34, last LBA 222, name "HUNTRESS EVIDENCE". Answer [34].
Time Trial (ranked, incorrect): the disk was GPT with two used entries, [346,472]. That answer was right; the miss was elsewhere (below).
Time Trial (untimed retry): a fresh variant, GPT with three used entries, [60,93,148].
Mastery: 12 sets, all CORRECT; the per-set layouts weren't recorded.

So the timed variants were the Single's template with more partitions. Every image recorded was GPT; the MBR and EBR paths were built and tested but not needed today.

Single Solve

The automated solver: stopped, nothing sent

The solver started the Single at 09:00:07 ET. It sorted the one question as a new field, its parser chain's best-effort answer was [], and it had no stored candidates for the slug, so it sent nothing. That stop was correct: [] would have been a guess.

The field (Claude)

Today's solver builds on the Day 23 Metadata chain and registers one field, disk-partition-start-lba-sequence (two aliases too): - GPT first: look for EFI PART at byte 512, or at 4096 for 4 KB sectors. Read the entry-array LBA, count, and entry size from the header; an entry is used when its type GUID isn't all zero; its start is the first LBA. - Otherwise MBR: the four primary slots with a non-zero type, each extended slot (0x05, 0x0F, 0x85) followed by the logical partitions in its EBR chain, as absolute LBAs. The chain walk stops on a loop, a missing 55 AA, or the end of the image. - Table order, not sorted, and no used partition raises an error rather than sending []. - Static only: the image is parsed as bytes.

Its tests: 6 passed (the real Single, MBR primaries with a gap, an MBR with two logical partitions, a GPT whose entries are out of order with an empty slot between them, no partitions, and the per-set flag).

[34] was accepted on the first try.

started_at  2026-10-28 09:00:07 ET   (started by the solver)
deadline    none (Single Solve)
answers     1   [34]
result      CORRECT   flag 82219ae6…65e4   (09:02:07.9, first try)

Per-step timings for the Single weren't recorded.

Rehearsal before the timed runs: a regression rehearsal against earlier days' puzzles, compared with the Day 23 solver: passed, 144 saved attempts, slowest 0.55 s, per-set identical; 143 identical, 1 newly solved (today's Single), 0 changed. It passed with a wrong answer in it (next section).

Time Trial

The ranked run: incorrect

Claude ran the ranked Time Trial with the new day's own entry point, not through the wrapper our automated solver uses for every Metadata timed mode.

That matters because of how our Metadata solver is built: the parser chain answers what it can, then a set of stored per-field rules overwrites the fields they cover. Day 25's registry-hive-root-name is answered only by that overlay. Run without it, the chain sent its best-effort none for the hive's root key, which was PagwSj.

ranked run without the stored-rule overlay
answers     disk [346,472] (right); registry-hive-root-name none (should have been PagwSj)
result      INCORRECT   (09:03:24)

The rehearsal couldn't have caught it: it doesn't apply the stored-rule overlay either, so it replayed the saved sets with the same none and still passed. Day 27's records had already noted the rehearsal printing a best-effort none for this field on older saved sets; this is why.

The fix and the untimed retry

09:04:47: the wrapper was pointed at today's solver, so it wraps today's chain.
Checked offline on the failed set: the wrapped solver changed one answer only, the hive root (none → PagwSj).
A plain untimed start replied expired (no open attempt); nothing was sent.
One untimed retry through the wrapper, with the stored rules applied.

untimed retry, through the wrapper
answers     disk [60,93,148] (three GPT entries); hive root from the stored-rule overlay
result      CORRECT   flag 0fb816a2…a034   (09:05:18.9)

Not ranked (Hall of Fame ineligible). A ranked Time Trial pass was still owed.

Mastery

CORRECT on the first attempt, ranked, run the right way: through the wrapper, 12 sets.

deadline    2026-10-28 09:11:53 ET   (13:11:53Z)
answers     12 sets
TOTAL       5.4 s
result      CORRECT   flag 49669c22…dea9   (09:05:32.5)

Time to solve

All three modes were recorded CORRECT by 09:05:32.5 ET, 5 min 32.5 s after release and 5 min 25 s after the solver's Single Solve start; the Single took 2 min 0.9 s from its start. The ranked Time Trial was incorrect and the CORRECT one came from an untimed retry, so it's unranked; the ranked Mastery went through on its first run.

Takeaways

By-hand Metadata timed runs go through the same wrapper as the automated solver. It applies the stored per-field rules; running the new day's own entry point skipped them and cost today's ranked Time Trial.
Point the wrapper at the new day first, then run through it; the two go together. The wrapper wraps whichever day's solver it's pointed at. Still on Day 23, it lacked today's field; the day's own entry point had the field but not the overlay. Only both steps, in that order, give the run the Mastery had.
A rehearsal is only as good as the path it replays. The rehearsal skips the overlay, so it passed a set the real run would have failed. Making it apply the overlay (or replay through the wrapper) closes that gap.
The warning was there a day early. Day 27's records noted a best-effort none for the hive root in the rehearsal and marked it "worth a look". It was the same field.
The new field was right every time. [34], [346,472], and [60,93,148] were all accepted: the GPT reader, built from the format with MBR/EBR fallbacks and tests, needed no change.
The prompt promises more than the questions ask, as on Days 26 and 27: "prove which image was rebuilt" had no field of its own in the records.