Part 5: And That’s a Wrap for the 2021 Capture the Flag (CTF)
At Cellebrite, we want to provide an annual CTF to enhance what you already know and hopefully teach you something new with each challenge.
Whether you are new to DFIR or a seasoned veteran, this CTF had something for you to learn. The questions were written so that some were easier while others were extremely challenging but not impossible.
Our hope was that you had fun and enjoyed the effort we put into creating solid data sets that you can also use after the CTF for your own testing and validation needs.
It is OK to not have been able to answer all the questions and if you missed the CTF altogether, don’t fret, we are providing the datasets and the walkthroughs for you to continue learning.
The datasets: This year we introduced a PC into our scenario. Due to sizing, some images were split into multiple .E01 files and some could have existed as several .zip files for easy download so make sure to put the .zip files into the same directory for unzipping.
We wrote a blog for each dataset to include walkthrough solutions.
Read the backstory in part 1 and follow the previous walk-throughs at the following links:
- Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
- Part 2: Walk-Through of Answers to the 2021 CTF – Marsha’s PC
- Part 3: Walk-Through of Answers to the 2021 CTF – Marsha’s iPhone (FFS and Backup)
- Part 4: Walk-Through of Answers to the 2021 CTF – Beth’s iPhone
After writing the first four blogs, a new post was released featuring iLEAPP and how useful it is in this CTF. Watch the DFIRScience video here: https://www.youtube.com/watch?v=Cp9QMauTRaM
For those who need instructions or help on leveraging Cellebrite Physical Analyzer in an examination, please check out the following resources:
- Fundamentals Matter Webinars – Getting started in a mobile investigation, leveraging key capabilities, and digging deeper.
- Ask The Expert – Many videos on how to leverage Cellebrite solutions.
- Cellebrite Blog – Dive into key topics of interest.
- Tip Tuesday – Weekly tips provided by Heather Mahalik
Stay tuned for the next CTF in 2022!