Blog >> Cellebrite CTF 2024 (Russell)

Solving Cellebrite CTF 2024 (Russell's Android)

08/11/2024 Friday

Cellebrites CTF follows up on Russell, Sharon, and Felix after Abe's arrest in last years CTF. Things start to take a turn when the new character Otto goes missing on a cruise trip. This blog covers solutions for some questions related to Russell's Android device using ArtiFast.



Artifacts Covered in this Challenge:


The Disco Era


Q: The 70’s were awesome, and Russell heard one of his favorite songs about the decade. Where was he when he heard it? Please provide the friendly name of the location.


Answer: Nationals Park. The hint given for this question is "It is a fruit". There are quite a few images and videos of a concert Russell attended, one of the bands performing is called "Smashing Pumpkins". The location name can be seen in the images.


Hot N Cold


Q: Russell got a limited-edition item. Who made it?


Answer: Golda. The picture PXL_20240719_175034254.MP.jpg is of an ice cream with “Summer Limited Edition” written on it.


The Artist Formally Known As


Q: Who knew his royal highness had a drink. What is in it? (Type the answer exactly as it is found)


Answer: Hendrick’s Gin with a touch of Sweet Violet and Lemon. Running the hint on google revealed the artist to be Prince. The picture PXL_20240620_225032472.jpg which is of a drink menu, has one listed as “Purple Rain” same as the name of a famous song of his.




Arrrggggghhhhh!


Q: Russell was reflecting on his life choices while on an aquatic adventure when he encountered another boat. What was the name of the other boat?


Answer: Scallywag. The picture PXL_20240620_215924602.jpg depicts him with his sunglasses on and a body of water in the background. The “reflection” on his sunglasses has the name of the boat.




I've Got to Drop


Q: Russell was in the middle of a meeting but was invited elsewhere. What was the destination? (Full official name of the location)


Answer: Ruth’s Chris Steakhouse. Russell received a message from Sharon on WhatsApp suggesting dinner at Ruth’s, he responds with “i’ll try to get out of my meeting” as shown in the screenshot below. He later receives an email from the restaurant thanking him for stopping by.




Whoopsie!


Q: What is the Google Account ID (not the email address) of the individual who uploaded Milgov.pdf to Google Drive?


Answer: 104977992696221642383. A search for the document name under the Android Google Drive Items artifact shows the owner to be hmahalik@gmail.com with the ID.


Anthem


Q: Russell saw an “unconventional and emotional melodic event.” Who was the headliner?


Answer: Green Day. Multiple images and videos of a concert can be found on his device. One of them was a picture green day performing. Extracting the coordinates from Exif artifact to get the location information and a quick google search confirms they were the headliners.






Drive Time


Q: Russell needed to update his driver license. What time did his phone start navigating to the driver license office?


Answer: 2024-08-02 13:42:48. It was the last trip recorded in Android Google Maps Last Trip artifact.