Blog >> Cellebrite's September 2023 CTF (Sharon)

Solving Cellebrite's September 2023 CTF (Sharon's Android device) Using ArtiFast

08/12/2023 Friday

Cellebrite held their yearly CTF last month and this year the challenge featured 4 devices, belonging to 4 different suspects. In this blog, We will use ArtiFast to answer the questions associated with one of the suspects devices (Sharon O'Neils Samsung Galaxy S21).


The Scenario:

Terror attacks were planned for Southport, NC in June of 2023. Russell, the primary suspect, lives locally in that area and seems to have been introduced to Abe via Sharon. Russell and Sharon go way back, and she seems to be the linchpin who tied Abe to Russell. So, who is Abe? How is he involved with Felix? Why would Felix be feeding a US person with information on nuclear power plants and weapons? Complete challenge details can be found Here


Artifacts Covered in this Challenge:


Sharon 01 - Chipset


Q: What is the chipset of Sharon’s Android?


In the samsung_SM-G991B.ufd file created with the extraction, we find under DeviceInfo the answer universal2100_r


Sharon 02 - What Happened


Q: What happened to the device on June 16, 2023 at 8:45:48 Eastern Daylight Time? (think of a setting change). Simply answer with the value field.


Plugged In. ArtiFast doesn't support the artifact required to answer this question at the moment.


Sharon 03 - Chat


Q: Sharon likes secure chat apps. When was the last time (in UTC) she entered a PIN to unlock a secure chat app? [YYYY-MM-DD HH:MM:SS]


In Signals Key Value artifact, the key “pin.last_successful_entry” with the timestamp as its value which is 2023-06-04 10:17:47


Sharon 04 - Address


Q: Sharon had a meeting with a co-conspirator near The Copper Penny on June 7, 2023. What is the exact street address of Sharon’s device when The Copper Penny was near? (Ex. 123 main street)


The answer is 485 N Water Street. Filtering the timeline to the above mentioned date, we see that EXIF artifact shows us screenshots from the DCIM folder that end with "Maps.jpg" in their names. On viewing the files we find that /Dump/data/media/0/DCIM/Screenshots/Screenshot_20230607_093927_Maps.jpg holds the coordinates of the specific location. Converting them to decimals and running a search on google maps gives us the street address.






Sharon 05 - Secure message


Q: A one-word text message was received with a photo that was stored as Private in a secure messaging app. What was the one-word text message?


In Android WhatsApp Image Messages we found 2 pictures under a “Private” folder. Checking the associated text message we find that the image IMG-20230601-WA0001.jpg was accompanied by the text “Mahalo”.




Sharon 06 - Facebook


Q: When did Sharon become friends with Abe Rudder on Facebook? (answer must be in YYYY-MM-DD)


Android Facebook Contacts shows it happened on 2023-06-01


Sharon 07 - Boat


Q: Sharon decided to crash the “Life at Cellebrite” party and took a train. The day after the party, she left on June 24, 2023 around 9:00 AM EDT and arrived at her final destination around 11:25 AM EDT. Which city did she start and end? (Answer must be in the following format: Las Vegas, Miami)


New York, Exton. ArtiFast doesn't support the artifact required to answer this question at the moment.


Sharon 08 - Location


Q: On June 16, 2023 Sharon was at “the home of the havoc” and shared her location with another suspect. Who did she share it with? (Answer must be in form of: first last)


The answer is Abe Rudder. A google search for “the home of the havoc” reveals its relation to Ice hockey. Filtering the timeline to 06/16/2023 we see a What3Words location link sent to Abe Rudder, followed by the message “The rink.” confirming the answer.


Sharon 09 - HotSpot


Q: Sharon connected to an iPhone mobile hotspot. What was the name of the mobile hotspot and the Month-Day the connection first occurred? [name, MM-DD]


The answer is Heather’s iPhone, 05-13. The hotspot name can be found under Android WIFI Information artifact. To get the initial connection date we check the file iwc_dump.txt.




Sharon 10 - PowerOn


Q: How many times did Sharon’s phone boot (power on and start up) while she was in Paris?


Boot occurred 2 times. A search for “Paris” shows timezone changes in Android Usage Log artifact. We know it first changed on 03/19/2023 06:07:15 and changed back to New York time on 03/28/2023 18:56:28. Between that time under the same artifact we see that the action android.intent.action.BOOT_COMPLETED occurs twice.


Sharon 11 - Note


Q: The user made a note on June 4, 2023 Eastern Daylight Time. What did the note say?


Keeping the EDT timezone mentioned in the above in mind, we search for the term “note”. Under Android WhatsApp Audio Messages artifact we find an audio note. On Navigating to and playing the note it gives the answer “Testing the audio app”.




Sharon 12 - Favorite


Q: As a reference to the previous question of Sharon sharing her location on June 16, 2023 with Abe: When did Abe favorite this location? (Answer must be YYYY-MM-DD HH:MM:SS local time to where Abe was when he saved it)


The answer is 2023-06-16 14:43:10 EDT. We know from question no.8 it was a What3Word link sent through WhatsApp, those are the places of interest we check on Abe’s device. Looking through the What3Words data files, 2 files of interest default.realm and Events-QafeEcXOSgScVMMQLRC3GA.sqlite are found. Using Realm Studio to open default.realm we can see below that an entry for the location sent was created on 2023-06-16 18:43:10 UTC.



The Events-QafeEcXOSgScVMMQLRC3GA.sqlite has no entries but its -wal file contains some data. Analysing the file Events-QafeEcXOSgScVMMQLRC3GA.sqlite-wal with an online tool FILExt we find that the location was saved on his device.


Sharon 13 – Take a break


Q: Sharon needed a break from the northeastern winter and headed south for a girl's trip for five days. While on her vacation, she saw her own dolphin. Where was she when she saw her dolphin? (Answer must be City, State).


The answer is Miami Florida. A tip of OSINT on real life characters was given. Heather who we know is Sharon in the challenge, posted on the app X, a picture of Miami followed by “Girls workout weekend. :)” on her feed. We are unable to confirm the answer using the dolphin tip.