Blog >> Cellebrite CTF 2024 (Felix)

Solving Cellebrite CTF 2024 (Felixs' iOS)

01/11/2024 Friday

Cellebrites CTF follows up on Russell, Sharon, and Felix after Abe's arrest in last years CTF. Things start to take a turn when the new character Otto goes missing on a cruise trip. This blog covers solutions for questions related to Felix's iOS device using ArtiFast.



Artifacts Covered in this Challenge:


One Two Many


Q: How many Chat applications are installed on Felix’s iPhone?


Answer: 13. Under iOS Installed Applications artifacts we can count the applications that are considered chat applications..


Mode Activated


Q: Which mode was AirDrop set to?


Answer: Contacts Only. Under iOS Sharing Information Artifact, the key value DiscoverableMode holds the answer.


Fresh Fruit


Q: Which email address for Felix is associated with his Life360 account?


Answer: felix.davey@orange.fr. Found under iOS Life360 Members artifact.


Is It Media or Medium?


Q: What is the MAC address of the keyboard found in Felix’s phone data?


Answer: 48:E1:5C:BE:A5:05. Given the hint, the bluetooth name Magic Keyboard stood out from Apple KnowledgeC Bluetooth Audio Connections.


Buh-Bye


Q: Which child was the last to be removed on 2024-09-07?


Answer: 42954. Solved by manually looking at log files. The child process ID was the last removed in launchd.log under /root/private/var/log/com.apple.xpc.launchd.


Early Present


Q: The user ordered a computer. What was the order number and when was it delivered? Answer format should be ORDER_NUMBER, DATE. Date should be in YYYY-MM-DD format.


Answer: W1579204413, 2024-08-06. Running searches for a few keywords and "order" returns some results of interest in Safari Web Activity. There are links to the Apple Store that were visited. On following this link https://store.apple.com/go/fr/vieworder/W1579204413/jpnoat@uriel-expert. It leads to the page in the screenshot below which contains the answers once translated to English from French.




One Day At A Time


Q: Felix had interest in developing and using a mobile application to help manage appointments. What is the MD5 hash of the file containing this text?


Answer: 5D9A80CA1B220E4F97C7EA83D19A70F7. Some data and conversations on this device are in French, so among the keywords searched the word “rendez-vous” leads to his conversations with chatGPT. A closer look at the text after translation reveals the topic, as can be seen in the screenshot below. The source column shows us where this information is being parsed from. I had chosen to calculate hashes while creating the case so from file view we obtain the MD5 hash.




what


Q: In the application what3words, which map was set as the default?


Answer: Apple. Looking through what3words related files, the settings information can be found in the preference file com.what3words.ios.what3words.plist.


Clean Slate


Q: What plist key on Felix's phone is documenting the setting for keeping messages?


Answer: SSKeepMessages. From iOS Message Preferences, the Keep Messages field shows it is set to forever. By viewing the evidence source on file view as plist, the key can be found.




The Forecast


Q: Felix looked up weather on September 4, 2024. Which locations were provided in response to his weather lookups? Answer must be location name only as it appears in the file, separated by commas, and in alphabetical order.


Answer: Marseille, Monaco, Paris, St-Genis-Laval. On the mentioned date 4 iOS Weather Data Location artifacts were recorded, organising the city names as instructed gave the correct answer.