Previous: Egg Hunt | iOS | Memory | AndroidThe last part of Magnet Virtual Summit CTF once again proved that not everything can be automatically parsed by the tools, you have to dive into the artifacts a bit to pull out the proper answers.WindowsBegin Exam Try 2 (5)When did the... [Read More]

Previous: Egg Hunt | iOS | MemoryThe Android image had some of the toughest questions yet in this CTF. This section gave me fits while playing live but giving it more time to digest and think it through, came out with almost all the answers.AndroidObfuscating Like a Pro (5)Chester decided... [Read More]

Previous: Egg Hunt | iOSThese questions were fairly straightforward if you know how to use Volatility but was a good refresher for me.MemoryHow's Your Memory? (5) Which memory profile best fits the system? Win8SP0x64 Win7SP1x86 VistaSP1x64 Win7SP0x86 Win10x86 Win7SP1x64 WinXPSP1x64 Win10x64 Running the imageinfo command through Volatility we see the... [Read More]

Previous: Egg HuntIf anything the iOS section of the Magnet CTF proved to me, you really need to deep dive into the database files to pull out all the information. I think it was fantastic how they made you go outside the box to find flags in this section.iOS DeviceAccount... [Read More]

Magnet Forensics put on another amazing CTF for their user (virtual) summit this year. Much thanks to the students from Champlain for the challenge. Now that the competition is officially over, I am finally getting around to dropping some walkthroughs on how I found the answers. First up is the... [Read More]