Enhance Training, Keep Playing with Cellebrite CTF 2023: Full List of Questions
Many of you have asked for a list of the questions so you can continue to play, use them for training and more. Here is that list. We separated them by character. Please follow our social media channels as we are working on a way to enable you to play year-round for learning purposes in the gaming format. Thanks to Ian Whiffin, this is being developed. When it is ready, we will announce it.
Backstory/Scenario:
Terror attacks were planned for Southport, NC in June of 2023. Russell, the primary suspect, lives locally to that area and seems to have been introduced to Abe via a Sharon. Russell and Sharon go way back, and she seems to be the linchpin who tied Abe to Russell. So, who is Abe? How is he involved with Felix? Why would Felix be feeding a US person with information on nuclear power plants and weapons? We intend to leave this scenario open-ended but wanted to give you some backstory.
Sharon’s Android Questions:
Sharon 01 – Chipset – Level 1 (10 points)
What is the chipset of Sharon’s Android?
Sharon 02 – What Happened – Level 1 (10 points)
What happened to the device on June 16, 2023 at 8:45:48 Eastern Daylight Time? (Think of a setting change). Simply answer with the value field.
Sharon 03 – Chat – Level 2 (30 points)
Sharon likes secure chat apps. When was the last time she entered a PIN to unlock a secure chat app?
Sharon 04 – Address – Level 2 (30 points)
Sharon had a meeting with a co-conspirator near The Copper Penny on June 7, 2023. What is the exact street address of Sharon’s device when The Copper Penny was near? (Ex. 123 main street).
Sharon 05 – Secure Message – Level 2 (30 points)
A one-word text message was received with a photo that was stored as Private in a secure messaging app. What was the one-word text message?
Sharon 06 – Facebook – Level 2 (30 points)
When did Sharon become friends with Abe Rudder on Facebook? (answer must be in YYYY-MM-DD).
Sharon 07 – Boat – Level 2 (30 points)
Sharon decided to crash the “Life at Cellebrite” party and took a train. The day after the party, she left on June 24, 2023 around 9:00 AM EDT and arrived at her final destination around 11:25 AM EDT. Which city did she start and end? (Answer must be in the following format: Las Vegas, White Fish).
Sharon 08 – Location – Level 2 (30 points) – This unlocks Question 12
On June 16, 2023 Sharon was at “the home of the havoc” and shared her location with another suspect. Who did she share it with? (Answer must be first and last name).
Sharon 09 – Hotspot – Level 3 (50 points)
Sharon connected to an iPhone mobile hotspot. What was the name of the mobile hotspot and the MM-DD the connection first occurred? (Answer must look like Jared Tesla, 06-09).
Sharon 10 – PowerOn – Level 3 (50 points)
How many times did Sharon’s phone boot (power on and start up) while she was in Paris?
Sharon 11 – Note – Level 3 (50 points)
The user made a note on June 4, 2023 Eastern Daylight Time. What did the note say?
Sharon 12 – Favorite – Level 3 (100 points)
As a reference to the previous question of Sharon sharing her location on June 16, 2023 with Abe, when did Abe favorite this location? Answer must be YYYY-MM-DD HH:MM:SS local time to where Abe was when he saved it. (Show answer as 2021-12-18 13;11:09 PST).
Sharon 13 – Take a break – Level 3 (100 points)
Sharon needed a break from the northeastern winter and headed south for a girl’s trip for five days. While on her vacation, she saw her own dolphin. Where was she when she saw her dolphin?
Abe’s iOS Questions:
Abe 01 – iCloud – Level 1 (10 points)
Abe used a unique email address for his iCloud account. What is that email address?
Abe 02 – Comm App – Level 1 (10 points)
Abe used different types of communication channels, through different applications.
What communication application was used the most?
Abe 03 – Wallet – Level 1 (10 points)
A payment card was used on that device’s Wallet. What are the last 4 digits of that card?
Abe 04 – iCloud Backup – Level 1 (10 points)
Abe’s phone was setup using iCloudBackup method. What is the Date & Time for that (UTC+0 time)?
Abe 05 – Tracking – Level 1 (10 points)
Abe was suspicious about being tracked. After searching the rental vehicle, he was using while in NJ, he found a device attached to his vehicle, what was the make/model (need to refine)?
Abe 06 – Steps – Level 2 (30 points)
Abe was not really active, on 6/24/2023 local time, how many steps were recorded?
Abe 07 – Bluetooth – Level 2 (30 points)
How many unique bluetooth connections were paired?
Abe 08 – App Notification – Level 2 (30 points)
Abe got notified by Harold of a potential arrest, Abe then opened which app?
Abe 09 – Parked- Level 2 (30 points)
Abe went to a party at RAIN Event Space, what is the name of the street (just the street name) for where he parked his vehicle?
Abe 10 – About – Level 2 (30 points)
What was Abe Rudder’s About bio on Whatsapp?
Abe 11 – Permissions – Level 2 (30 points)
Abe is paranoid and not always giving access to everything. One of the apps Abe used on the iPhone received access to Photos however as an “Add Photos Only” permission. What is the name of the app (one word i.e: Starbucks).
Abe 12 – Email – Level 3 (50 points)
Abe used a specific method to find/check/share locations via an app. In order to keep privacy up, Abe signed up with a different email address which keeps it isolated to that vendor. What is that email address?
Abe 13 – Search- Level 3 (50 points)
Abe got suspicious when he had to deal with some shady deal and people almost as if a crime was known to be committed so wanted to leave no traces. Abe wanted to create an anonymous email. Where did Abe search for that? (3 words).
Abe 14 – Navigation- Level 3 (50 points)
Abe was navigating while driving, on 6/26/23. What was the destination address on the navigation?
Abe 15 – Crypto – Level 2 (30 points)
Abe used MOB to send/receive crypto within Signal. Can you find the Recovery Phrase for Signal Mobile Coin wallet? What is it? (24 words)
Abe 16 – Picture – Level 2 (30 points)
Abe loves taking pictures and videos on the iPhone, the problem is when Abe is trying to look for a picture, he is having hard time finding it therefore he utilizes the Search within the Apple Photos app. If Abe would have looked for a picture of: Myself, Pawel, and Hat he would end up with one photo. Can you name that filename?
Abe 17 – Location – Level 2 (30 points)
Abe went for some shady meeting on an island but tried to conceal as a vacation so he took a boat tour and saw dolphins. He then decided to mark a location with “dolphins”. What was the timestamp for that location [HH:MM:SS] written in UTC time?
Abe 18 – BokerTov- Level 3 (100 points)
Within the last month before Abe got arrested (and his device was extracted), Abe used to wake up naturally however, there was one day the phone woke him up instead. What was the day and (local) time?
Felix’s iOS Questions:
Felix 01 – Voicemail – Level 1 (10 points)
Felix received a voicemail from +1 416-435-5684. How many seconds in length was the voicemail message?
Felix 02 – Picture – Level 1 (10 points)
Please look at the following picture: IMG_0026.HEIC. How many times do you see this picture on the device? (Including thumbnails).
Felix 03 – Confirmation – Level 1 (10 points)
Felix confirmed receiving “everything.” When Felix sent the confirmation, which account did he send it from?
Felix 04 – Photo– Level 1 (10 points)
Private Photo Vault is an application that is installed on the phone. What is the passcode to the application?
Felix 05 – Location – Level 1 (10 points)
Felix always had an interest in the USA. What application did he use to search an address in New Jersey USA?
Felix 06a – Size – Level 2 (30 points)
What is the size (in bytes) of the ChatStorage.sqlite-wal file? (Answer with numeric digit(s) only).
Felix 06b – Time – Level 2 (30 points)
What is the date and time the –WAL file committed to the main database? (Type answer: MM/DD/YYYY HH:MM:SS, correct time should be converted to UTC+0 but you do not need to type UTC+0).
Felix 07 – Active – Level 2 (30 points)
When was the SIM Card information on this phone last updated? (Raw string, not converted).
Felix 08 – Missing – Level 2 (30 points)
The WhatsApp chat database appears to be missing some chat messages. Assuming the highest number is the last message, how many messages are missing?
Felix 09 – Wiped – Level 2 (30 points)
When was this device last wiped? (Type answer: MM/DD/YYYY HH:MM:SS, correct time should be converted to UTC+0 but you do not need to type UTC+0).
Felix 10 – Cruise– Level 2 (30 points)
Felix was researching / surveilling a ship as a possible target and downloaded a photo of it. What is the name of the cruise ship?
Felix 11 – Data – Level 3 (50 points)
Which process on the phone used the most cellular data (network traffic INTO the device)?
Felix 12 – H is Mean – Level 3 (100 points)
Felix was referred information about pension reform. What is the SID associated with that artifact?
Russell’s Android Questions:
Russell 01 – Call – Level 1 (10 points)
Russell got a FaceTime call. When did he join it (UTC)?
Russell 02 – Bluetooth – Level 1 (10 points)
Which user profile on Russell’s phone last connected to his bluetooth speaker?
Russell 03a – App – Level 1 (10 points)
What app did Russell use to send location information to the group?
Russell 03b – Directions– Level 3 530 points)
Did Russell get directions to the location described in the previous question? If so, when (UTC)? (Answer must be in YYYY-MM-DD HH-MM-SS).
Russell 04 – Signal – Level 1 (10 points)
Was Signal used under Profile 10? Answer must be shown as Yes or No.
Russell 05 – Phone – Level 2 (30 points)
Associate the phone number(s) of the phone with the correct ICCID, IMSI, and Carrier.
Russell 06 – Navigate – Level 3 (50 points)
Russell went on coastal vacation. Where did he stay (actual residential address) and when did he first navigate there (UTC)? Answer must be in this format 123 main street, New Haven, CT 12345, 2021-05-12 19:11:16.
Russell 07 – Meetup – Level 2 (30 points)
Sharon, Abe, and Russell all met in-person. When & where (name of location)? Answer must be shown as TGI Fridays, Vienna VA, 2022-05-08 13:10).
Russell 08 – Mjolnir – Level 2 (30 points)
Mjolnir makes an appearance on Russell’s phone. Which app did it come from?
Russell 09 – Signal – Level 2 (30 points)
When was the last time Signal was launched (opened) under Profile 10?
Russell 10 – Big MAC – Level 3 (50 points)
Russell liked to cover his tracks while traveling and connecting to WiFi. What was MAC address used on 2023-06-07 at approximately 23:27 UTC? [XX:XX:XX:XX:XX:XX]
Russell 11 – Navigate – Level 3 (50 points)
Russell went on coastal vacation. when did he first navigate there (UTC)? Answer must be in this format 2021-05-12 19:11:16.
Russell 12 – Location – Level 3 (100 points)
Russell called an audible and sent Abe a new location. What was the location?