How frankwxu/digital-forensics-lab-p2 works
This repository is a collection of digital-forensics challenge materials and small, standalone analysis scripts, not a unified application. The investigator’s workflow is to choose a device-specific question, inspect the corresponding evidence or run a focused script, and interpret the resulting artifact or lookup. Sampled scripts demonstrate iPhone call-time and location lookups, chat-thread export and participant extraction, and Android file-hash searching. Other challenge directories indicate additional investigation topics, but their implementations and wiring were not sampled, so those links are left unspecified.
Main entry points: location.py Location lookup · time.py Call lookup · convert_plist.py Chat export · cover.py Chat export variant
Components 34
Beth iPhone
- Email evidence
CTF_Beth_iPhone/01_Email_Address - Call lookup
CTF_Beth_iPhone/02_User_Location/time.py - Location lookup
CTF_Beth_iPhone/02_User_Location/location.py - Location notebook
CTF_Beth_iPhone/02_User_Location/Call_Location.ipynb - Extraction format
CTF_Beth_iPhone/03_Extraction_Container_Format_version - Activity timelines
CTF_Beth_iPhone/04_Activity_Timelines - Chat export
CTF_Beth_iPhone/05_Chat_History/convert_plist.py - Chat export variant
CTF_Beth_iPhone/05_Chat_History/cover.py - Participant lookup
CTF_Beth_iPhone/05_Chat_History/pass.py - Chat SQLite data
- Physical movement
CTF_Beth_iPhone/06_Track_User_Physical_Movement - Mobile equipment ID
CTF_Beth_iPhone/07_Mobile_Equipment_ID - Apple ID
CTF_Beth_iPhone/08_Apple_ID - File metadata
CTF_Beth_iPhone/09_File_Metadata - Weather city
CTF_Beth_iPhone/10_Name_of_City_Set_for_Weather_Forecast_Feed - CPU ID
CTF_Beth_iPhone/11_CPU_ID - Search keywords
CTF_Beth_iPhone/12_Search Keywords
Heisenberg Android
- ALEAPP setup
CTF_Heisenberg_Android_Phone/00_Getting_Started_And_ALEAPP - App packages
CTF_Heisenberg_Android_Phone/01_Search_for_App_Package - License plates
CTF_Heisenberg_Android_Phone/02_Package_To_Look_Up_License_Plates - File search
CTF_Heisenberg_Android_Phone/03_File_Search - Wi-Fi password
CTF_Heisenberg_Android_Phone/04_Wifi_Password - Bluetooth address
CTF_Heisenberg_Android_Phone/05_Bluetooth_MAC_Address - Contact number
CTF_Heisenberg_Android_Phone/06_Contact_Phone_Number - Phone location
CTF_Heisenberg_Android_Phone/07_Loation_Phone_Operated - Image metadata
CTF_Heisenberg_Android_Phone/08_Images_Metadata - Device IMSI
CTF_Heisenberg_Android_Phone/09_Device_IMSI - MD5 search
CTF_Heisenberg_Android_Phone/10_MD5_Image_and_Package/imagemd5.py - Instagram reel
CTF_Heisenberg_Android_Phone/11_Instagram_Reel - Last opened app
CTF_Heisenberg_Android_Phone/12_Last_Opened_Instagram_App - Burner card
CTF_Heisenberg_Android_Phone/13_Burner_Credit_Card - Meeting details
CTF_Heisenberg_Android_Phone/14_Meeting_Street_Name_And_Time
Marsha iPhone
- iCloud address
CTF_Marsha_iPhone/01_iCloud_Address
Other components
- Investigator
Connections 12
- Investigator → Call lookup: queries
- Investigator → Location lookup: queries
- Investigator → Chat export: runs
- Investigator → Chat export variant: runs
- Investigator → Participant lookup: queries
- Investigator → MD5 search: runs
- Call lookup → Chat SQLite data: reads calls
- Location lookup → Chat SQLite data: reads locations
- Chat export → Chat SQLite data: reads threads
- Chat export variant → Chat SQLite data: reads threads
- Participant lookup → Chat SQLite data: queries messages
- Location lookup → Investigator: prints place