Missed a blog post last month but here we have some new items this time around. As always, feel free to reach out to me if you have links for me to look at or have gotten use out of the StartMe page.If you'd like to nominate my page for... [Read More]

Another research opportunity came out of the Cellebrite CTF last week. Reading through some writeups I came across Williams Kosasi's breakdown (read it, it's really good). In answering the iOS version question, he came across the restore.log at the path:private/var/mobile/MobileSoftwareUpdate/restore.logThere are a lot of unfamiliar log files found on iOS... [Read More]

Playing CTF's has taught me so many things over the past years, case in point this blog post. In the recent Cellebrite CTF, there was a question for the Samsung phone evidence about battery life and shutdown events.How many times did Heisenberg's Android power off due to the battery being... [Read More]

Previous: Heisenberg's Android | Beth's iPhone | Marsha's iPhone | Marsha's PCFor the last piece of evidence for the CTF we get Marsha's Backup. No links were provided for the backup but it can be found in the forensic image for Marsha's PC. It can be found at the following... [Read More]

Previous: Heisenberg's Android | Beth's iPhone | Marsha's iPhoneMarsha's PC had the most questions out of them all but probably the easiest one.Evidence: https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.001https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.002https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.003https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.004https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Marsha_PC_Physical_DC_2021-07-29.zip.005Password: 02DB2ECE91DB67E8FA939FC3DC15D16BBackup and syncing data (10 points)Were any backups located on the PC? If so, what is the name of the device that was backed up?If we mount... [Read More]