• Forensics StartMe Updates (11/1/2021)

    By Kevin Pagano
    Missed a blog post last month but here we have some new items this time around. As always, feel free to reach out to me if you have links for me to look at or have gotten use out of the StartMe page.If you'd like to nominate my page for... [Read More]
  • Restore Log - Tracking iOS Update History

    By Kevin Pagano
    Another research opportunity came out of the Cellebrite CTF last week. Reading through some writeups I came across Williams Kosasi's breakdown (read it, it's really good). In answering the iOS version question, he came across the restore.log at the path:private/var/mobile/MobileSoftwareUpdate/restore.logThere are a lot of unfamiliar log files found on iOS... [Read More]
  • Samsung Power Off Reset Logs

    By Kevin Pagano
    Playing CTF's has taught me so many things over the past years, case in point this blog post. In the recent Cellebrite CTF, there was a question for the Samsung phone evidence about battery life and shutdown events.How many times did Heisenberg's Android power off due to the battery being... [Read More]
  • Cellebrite CTF 2021 - Marsha's PC

    By Kevin Pagano
    Previous: Heisenberg's Android | Beth's iPhone | Marsha's iPhoneMarsha's PC had the most questions out of them all but probably the easiest one.Evidence: https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.001https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.002https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.003https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.004https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.005Password: 02DB2ECE91DB67E8FA939FC3DC15D16BBackup and syncing data (10 points)Were any backups located on the PC? If so, what is the name of the device that was backed up?If we mount... [Read More]