Previous: Week 1 | Week 2 | Week 3As we proceed onward with Week 4 and the last week of Android, we get to deep dive into databases and logs.Challenge 4 (10/26-11/2) Animals That Never Forget (25)Chester likes to be organized with his busy schedule. Global Unique Identifiers change often,... [Read More]

Previous: Week 1 | Week 2Week 3 was an absolute doozy and what a relief to knock it out! Given 3 chances (now 4) to answer it, I definitely needed a few extra to get it correctly.Challenge 3 (OCT 19-25) Cargo Hold (40)Which exit did the device user pass by... [Read More]

Previous: Week 1Week 2 is here and we have another question for the Magnet Forensics weekly CTF. This week we will delve into some web browser artifacts.Challenge 2 (OCT 12-18) PIP Install (30)What domain was most recently viewed via an app that has picture-in-picture capability?The wording threw me off a little... [Read More]

 The good folks at Magnet Forensics are hosting a weekly CTF challenge for anyone interested. More details on registration and scoring here. It kicked off this week with a question from Jad.Challenge 1 (OCT 5-11) - Mapping the Digits (20)What time was the file that maps names to IP's recently... [Read More]

This would have been the first year I would have made the trip down to Austin, Texas for the SANS DFIR Summit, but the pandemic really screwed that one up (hopefully next year). Despite the conference going virtual, it went off without too many hitches. There were so many incredible... [Read More]