Daily Blog #678: Sunday Funday 4/19/20 - Zoom from a DFIR Perspective Challenge

Zoom from a DFIR Perspective Challenge




Hello Reader,
         We had some strong contenders for last weeks contest and I think most of you understood the expedited need to understand more about these virtual conferencing technologies in this work from home world we are in. Let's then continue our journey by looking into an application that has been much in the news of late, Zoom. It's time to put your skills to use by letting the community know what they can recover from the Zoom video conference app.

Please note as with last weeks challenge I'm not specifying an operating system. You are allowed to test/research/document any zoom client you have access to. If you do more than one that could be how your submission comes over the line to a win.




The Prize:

$100 Amazon Giftcard

The Rules:

  1. You must post your answer before Friday 4/24/20 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful
  6. Anonymous entries are allowed, please email them to dlcowen@gmail.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post


The Challenge:
When looking at Zoom from a DFIR perspective:
1. Where are the artifacts?
2. What format are they in?
3. Can you recover chat history?
4. Can you recover call history?
5. Anything else you can determine?

Also Read: Daily Blog #677

Post a Comment