Deagler's 4n6 Blog

The following is the week 3 writeup for the Magnet Weekly CTF Challenge and this week's challenge looked like this: Seeing the words "Which exit did the device user pass by" and "Cargo" made me wonder if I should look for a sign that has an exit ID on it. Despite that, none of the Photos found from the Android image showed nothing like a sign: Magnet Forensic Staff normally would give some hints on this week's challenge on their YouTube channel on Monday 11ET and so did they last week .  I had to say Jessica Hyde's hint was instrumental for me to crack this challenge quickly. With some Google searches, the webminar mentioned by Jessica could be found. This webminar was delivered by Jessica Hyde and Christopher Vance and the topic was about the comparison of artifacts between Android and iOS. The highlighted part from the above screenshot immediately caught my attention and I suddenly realized I had to look at the Motion Photos on the Android image. &quo

Magnet recently rolled out the very first  Magnet Weekly CTF Challenge . From Oct 5, 2020, a new challenge would be provided for the CTF participants to solve on every Monday at 11 AM ET until the end of 2020.  In fact, I only found out this CTF event on week 2, therefore missed week 1's challenge. To be honest, it is a bit of pity for me. Regardless, I still found fulfilment from cracking the new challenges and learning from other people's write-ups😀. If you were still reading this blog entry in Oct 2020, I suppose it would not be too late to join the CTF and have fun from it. For all challenges on Oct 2020, an Android image would be used for analysis. And the challenge of week 2 looked like this: Seeing the "What domain was most recently viewed via an app" part made me wonder if I needed to look into web browsing history on the Android image first. Just in case you don't know about the "picture-in-picture" (PIP) capability from Android, Android Deve