Daily Blog #658: MUS 2019 DFIR CTF Perfect Score Achieved

MUS 2019 DFIR CTF Perfect Score Achieved

Hello Reader,
           Just a note that we already have a perfect score winner!

MUS 2019 DFIR CTF Perfect Score Achieved

Congratulations to Plop aka Bastien Lardy who I will be contacting about their prize!

The CTF will remain up for quite some time to allow all of you a chance to learn and get ready for the big DFIR CTF of the year, the Defcon Unofficial DFIR CTF!

Also Read: Daily Blog #657


  1. Mobile > Analysis (15)
    What country was the mobile device owner in when reading a document that was "IN MEMORY OF MOE"?

    where is the actual document file located - in mobile or takeout? exact filepath?

  2. Mobile > App Download Methods (10)
    Which of the following apps was NOT downloaded from Google Play?

    where is the evidence for YouTube found?

  3. Mobile > Time Zone (10)
    What time zone was the phone in on Dec 9th?

    answer is purely based on roaming SMS text messages received, yes?

  4. Activity > Sharepoint 4 (5)
    Which was retrieved from the sharepoint first?

    where is the evidence for this?

  5. i wasn't able to bitlocker decrypt the secret .vhd on my host running Windows 7 (i managed to do it on my other host running Windows 10), was someone else able to do it on Windows 7?

  6. Basic - Desktop > UTC Offset (2)
    What was the timezone offset at the time of imaging?

    where is the evidence for this? i don't see it inside MUS-CTF-19-DESKTOP-001.E01.txt