# frankwxu/digital-forensics-lab-p2 architecture

> Architecture diagram of the GitHub repository frankwxu/digital-forensics-lab-p2, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/frankwxu/digital-forensics-lab-p2
- Repository: https://github.com/frankwxu/digital-forensics-lab-p2
- Video tour (about a minute): https://gitdiagram.com/frankwxu/digital-forensics-lab-p2/video

## Overview

This repository is a collection of digital-forensics challenge materials and small, standalone analysis scripts, not a unified application. The investigator’s workflow is to choose a device-specific question, inspect the corresponding evidence or run a focused script, and interpret the resulting artifact or lookup. Sampled scripts demonstrate iPhone call-time and location lookups, chat-thread export and participant extraction, and Android file-hash searching. Other challenge directories indicate additional investigation topics, but their implementations and wiring were not sampled, so those links are left unspecified.

Main entry points: [`CTF_Beth_iPhone/02_User_Location/location.py`](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/location.py) (Location lookup), [`CTF_Beth_iPhone/02_User_Location/time.py`](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/time.py) (Call lookup), [`CTF_Beth_iPhone/05_Chat_History/convert_plist.py`](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/convert_plist.py) (Chat export), [`CTF_Beth_iPhone/05_Chat_History/cover.py`](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/cover.py) (Chat export variant)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_beth["Beth iPhone"]
  node_email["Email evidence"]
  node_calllookup["Call lookup<br/>[time.py]"]
  node_locationlookup["Location lookup<br/>[location.py]"]
  node_locationnotebook["Location notebook"]
  node_extraction["Extraction format"]
  node_activity["Activity timelines"]
  node_chatconvert["Chat export<br/>[convert_plist.py]"]
  node_chatcover["Chat export variant<br/>[cover.py]"]
  node_chatparticipants["Participant lookup<br/>[pass.py]"]
  node_chatdb[("Chat SQLite data")]
  node_movement["Physical movement"]
  node_deviceid["Mobile equipment ID"]
  node_appleid["Apple ID"]
  node_filemetadata["File metadata"]
  node_weathercity["Weather city"]
  node_cpuid["CPU ID"]
  node_keywords["Search keywords"]
end

subgraph group_heisenberg["Heisenberg Android"]
  node_androidstart["ALEAPP setup"]
  node_package["App packages"]
  node_plates["License plates"]
  node_filesearch["File search"]
  node_wifi["Wi-Fi password"]
  node_bluetooth["Bluetooth address"]
  node_contact["Contact number"]
  node_carrierlocation["Phone location"]
  node_image_metadata["Image metadata"]
  node_imsi["Device IMSI"]
  node_md5search["MD5 search<br/>[imagemd5.py]"]
  node_reel["Instagram reel"]
  node_lastapp["Last opened app"]
  node_creditcard["Burner card"]
  node_meeting["Meeting details"]
end

subgraph group_marsha["Marsha iPhone"]
  node_marshaicloud["iCloud address"]
end

node_investigator(("Investigator"))

node_investigator -->|"queries"| node_calllookup
node_investigator -->|"queries"| node_locationlookup
node_investigator -->|"runs"| node_chatconvert
node_investigator -->|"runs"| node_chatcover
node_investigator -->|"queries"| node_chatparticipants
node_investigator -->|"runs"| node_md5search
node_calllookup -->|"reads calls"| node_chatdb
node_locationlookup -->|"reads locations"| node_chatdb
node_chatconvert -->|"reads threads"| node_chatdb
node_chatcover -->|"reads threads"| node_chatdb
node_chatparticipants -->|"queries messages"| node_chatdb
node_locationlookup -->|"prints place"| node_investigator

click node_email "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/01_Email_Address"
click node_calllookup "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/time.py"
click node_locationlookup "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/location.py"
click node_locationnotebook "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/Call_Location.ipynb"
click node_extraction "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/03_Extraction_Container_Format_version"
click node_activity "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/04_Activity_Timelines"
click node_chatconvert "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/convert_plist.py"
click node_chatcover "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/cover.py"
click node_chatparticipants "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/pass.py"
click node_movement "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/06_Track_User_Physical_Movement"
click node_deviceid "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/07_Mobile_Equipment_ID"
click node_appleid "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/08_Apple_ID"
click node_filemetadata "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/09_File_Metadata"
click node_weathercity "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/10_Name_of_City_Set_for_Weather_Forecast_Feed"
click node_cpuid "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/11_CPU_ID"
click node_keywords "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/12_Search%20Keywords"
click node_androidstart "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/00_Getting_Started_And_ALEAPP"
click node_package "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/01_Search_for_App_Package"
click node_plates "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/02_Package_To_Look_Up_License_Plates"
click node_filesearch "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/03_File_Search"
click node_wifi "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/04_Wifi_Password"
click node_bluetooth "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/05_Bluetooth_MAC_Address"
click node_contact "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/06_Contact_Phone_Number"
click node_carrierlocation "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/07_Loation_Phone_Operated"
click node_image_metadata "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/08_Images_Metadata"
click node_imsi "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/09_Device_IMSI"
click node_md5search "https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Heisenberg_Android_Phone/10_MD5_Image_and_Package/imagemd5.py"
click node_reel "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/11_Instagram_Reel"
click node_lastapp "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/12_Last_Opened_Instagram_App"
click node_creditcard "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/13_Burner_Credit_Card"
click node_meeting "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/14_Meeting_Street_Name_And_Time"
click node_marshaicloud "https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Marsha_iPhone/01_iCloud_Address"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_email,node_calllookup,node_locationlookup,node_locationnotebook,node_extraction,node_activity,node_chatconvert,node_chatcover,node_chatparticipants,node_chatdb,node_movement,node_deviceid,node_appleid,node_filemetadata,node_weathercity,node_cpuid,node_keywords toneBlue
class node_androidstart,node_package,node_plates,node_filesearch,node_wifi,node_bluetooth,node_contact,node_carrierlocation,node_image_metadata,node_imsi,node_md5search,node_reel,node_lastapp,node_creditcard,node_meeting toneAmber
class node_marshaicloud toneMint
class node_investigator toneIndigo
```

## Components

### Beth iPhone

- [Email evidence](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/01_Email_Address): `CTF_Beth_iPhone/01_Email_Address`
- [Call lookup](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/time.py): `CTF_Beth_iPhone/02_User_Location/time.py`
- [Location lookup](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/location.py): `CTF_Beth_iPhone/02_User_Location/location.py`
- [Location notebook](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/02_User_Location/Call_Location.ipynb): `CTF_Beth_iPhone/02_User_Location/Call_Location.ipynb`
- [Extraction format](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/03_Extraction_Container_Format_version): `CTF_Beth_iPhone/03_Extraction_Container_Format_version`
- [Activity timelines](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/04_Activity_Timelines): `CTF_Beth_iPhone/04_Activity_Timelines`
- [Chat export](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/convert_plist.py): `CTF_Beth_iPhone/05_Chat_History/convert_plist.py`
- [Chat export variant](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/cover.py): `CTF_Beth_iPhone/05_Chat_History/cover.py`
- [Participant lookup](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Beth_iPhone/05_Chat_History/pass.py): `CTF_Beth_iPhone/05_Chat_History/pass.py`
- **Chat SQLite data**
- [Physical movement](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/06_Track_User_Physical_Movement): `CTF_Beth_iPhone/06_Track_User_Physical_Movement`
- [Mobile equipment ID](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/07_Mobile_Equipment_ID): `CTF_Beth_iPhone/07_Mobile_Equipment_ID`
- [Apple ID](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/08_Apple_ID): `CTF_Beth_iPhone/08_Apple_ID`
- [File metadata](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/09_File_Metadata): `CTF_Beth_iPhone/09_File_Metadata`
- [Weather city](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/10_Name_of_City_Set_for_Weather_Forecast_Feed): `CTF_Beth_iPhone/10_Name_of_City_Set_for_Weather_Forecast_Feed`
- [CPU ID](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/11_CPU_ID): `CTF_Beth_iPhone/11_CPU_ID`
- [Search keywords](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Beth_iPhone/12_Search%20Keywords): `CTF_Beth_iPhone/12_Search Keywords`

### Heisenberg Android

- [ALEAPP setup](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/00_Getting_Started_And_ALEAPP): `CTF_Heisenberg_Android_Phone/00_Getting_Started_And_ALEAPP`
- [App packages](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/01_Search_for_App_Package): `CTF_Heisenberg_Android_Phone/01_Search_for_App_Package`
- [License plates](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/02_Package_To_Look_Up_License_Plates): `CTF_Heisenberg_Android_Phone/02_Package_To_Look_Up_License_Plates`
- [File search](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/03_File_Search): `CTF_Heisenberg_Android_Phone/03_File_Search`
- [Wi-Fi password](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/04_Wifi_Password): `CTF_Heisenberg_Android_Phone/04_Wifi_Password`
- [Bluetooth address](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/05_Bluetooth_MAC_Address): `CTF_Heisenberg_Android_Phone/05_Bluetooth_MAC_Address`
- [Contact number](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/06_Contact_Phone_Number): `CTF_Heisenberg_Android_Phone/06_Contact_Phone_Number`
- [Phone location](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/07_Loation_Phone_Operated): `CTF_Heisenberg_Android_Phone/07_Loation_Phone_Operated`
- [Image metadata](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/08_Images_Metadata): `CTF_Heisenberg_Android_Phone/08_Images_Metadata`
- [Device IMSI](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/09_Device_IMSI): `CTF_Heisenberg_Android_Phone/09_Device_IMSI`
- [MD5 search](https://github.com/frankwxu/digital-forensics-lab-p2/blob/main/CTF_Heisenberg_Android_Phone/10_MD5_Image_and_Package/imagemd5.py): `CTF_Heisenberg_Android_Phone/10_MD5_Image_and_Package/imagemd5.py`
- [Instagram reel](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/11_Instagram_Reel): `CTF_Heisenberg_Android_Phone/11_Instagram_Reel`
- [Last opened app](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/12_Last_Opened_Instagram_App): `CTF_Heisenberg_Android_Phone/12_Last_Opened_Instagram_App`
- [Burner card](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/13_Burner_Credit_Card): `CTF_Heisenberg_Android_Phone/13_Burner_Credit_Card`
- [Meeting details](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Heisenberg_Android_Phone/14_Meeting_Street_Name_And_Time): `CTF_Heisenberg_Android_Phone/14_Meeting_Street_Name_And_Time`

### Marsha iPhone

- [iCloud address](https://github.com/frankwxu/digital-forensics-lab-p2/tree/main/CTF_Marsha_iPhone/01_iCloud_Address): `CTF_Marsha_iPhone/01_iCloud_Address`

### Other components

- **Investigator**

## Connections

- Investigator → Call lookup: queries
- Investigator → Location lookup: queries
- Investigator → Chat export: runs
- Investigator → Chat export variant: runs
- Investigator → Participant lookup: queries
- Investigator → MD5 search: runs
- Call lookup → Chat SQLite data: reads calls
- Location lookup → Chat SQLite data: reads locations
- Chat export → Chat SQLite data: reads threads
- Chat export variant → Chat SQLite data: reads threads
- Participant lookup → Chat SQLite data: queries messages
- Location lookup → Investigator: prints place