Saturday, April 6, 2019

Daily Blog #658: MUS 2019 DFIR CTF Perfect Score Achieved

Hello Reader,
           Just a note that we already have a perfect score winner!



Congratulations to Plop aka Bastien Lardy who I will be contacting about their prize!

The CTF will remain up for quite some time to allow all of you a chance to learn and get ready for the big DFIR CTF of the year, the Defcon Unofficial DFIR CTF!

6 comments:

  1. Mobile > Analysis (15)
    What country was the mobile device owner in when reading a document that was "IN MEMORY OF MOE"?

    where is the actual document file located - in mobile or takeout? exact filepath?

    ReplyDelete
  2. Mobile > App Download Methods (10)
    Which of the following apps was NOT downloaded from Google Play?

    where is the evidence for YouTube found?

    ReplyDelete
  3. Mobile > Time Zone (10)
    What time zone was the phone in on Dec 9th?

    answer is purely based on roaming SMS text messages received, yes?

    ReplyDelete
  4. Activity > Sharepoint 4 (5)
    Which was retrieved from the sharepoint first?

    where is the evidence for this?

    ReplyDelete
  5. i wasn't able to bitlocker decrypt the secret .vhd on my host running Windows 7 (i managed to do it on my other host running Windows 10), was someone else able to do it on Windows 7?

    ReplyDelete
  6. Basic - Desktop > UTC Offset (2)
    What was the timezone offset at the time of imaging?

    where is the evidence for this? i don't see it inside MUS-CTF-19-DESKTOP-001.E01.txt

    ReplyDelete