2022 U.S. Asia Cup 8th China Electronic Data Forensics Competition-Individual Competition
I TEL15543132658 and wechat, this content is my personal problem-solving ideas, different opinions are welcome to discuss.
Download link of inspection material file: https://pan.baidu.com/s/1kg8FMeMaj6BIBmuvUZHA3Q?pwd=ngzs
Extraction code: ngzs
Download file decompression password for individual competition and team competition: MeiyaCup2022
Decompression time for individual competition:
about 45min for
team competition Time:
about 1h20min
Decryption key of encrypted container for individual competition
CZDGm#&2_Ns$7wSMn%ZGr7xntcHS7d5uFta#Up9544jx_cvP$uFM7?pTDa*jN&QyFDLS8U%hx$fXN^BY$Xsj+3@F^y#4QFXb*Uq@wLmkCE7?&Yp+nX6s@hKrzpVE%v?&
Encrypted Container Decryption Key for Team Competition
av?5CAXw;&N`X)6)%B>Y<`Gx[IVq<5F;mAQp]b@ftYpF6v,*88~%wF*CS}.w*7"S(,I[gJE((9cwT@zEh2mY$AK[aZzW&JFR<\FE}RC\Gjx[!ec^GrDne]xK)SuUPMWX
I. Details of the case
In October 2022, a citizen accidentally provided personal credit card information on a fake website set up by the culprits after receiving an email from a counterfeit courier company, resulting in economic losses. After tracing, the police found that the credit card of one of the defrauded citizens, Li Dahui (TaiFai), had been used by criminals to shop in shops in the area. Later, based on the IP address, the police locked and arrested a man, Lin Junxi (阿希ChunHei), and found a batch of computers and mobile devices believed to have been used to commit crimes in his residence.
After investigation, the police found that in addition to the above-mentioned cases, Ah Xi was also involved in other criminal activities.
The police's electronic data forensics team conducted a preliminary investigation at the scene and conducted electronic data forensics on the devices involved. Please help restore the incident based on the information you have obtained.
II. Police Information
A) Materials related to 'Lim Jun Hee'
No. 1 Lin Junxi’s investigative report
File path Meiya_cup_2022/Individual/Report/ChunHei/Lin Junxi’s investigative report.pdf
Hash value:
SHA256 1CB8F69DACF1A8DB84F1F0208C46210827C5E182D316F7F9A4AE4CFBB8EBC859
No. 2 Electronic data of Lin Junxi’s mobile phone
File path Meiya_cup_2022/Individual/Image/ChunHei/ChunHei_iphone
Hash value:
SHA256 34AC7A2B5C3F51563076A758B28088FE92637A4C9E20A60D0F39C23389F51159
No. 3 Electronic data of Lin Junxi’s computer
File path Meiya_cup_2022/Individual/Image/ChunHei/ChunHei_Desktop
Hash value:
SHA256 49177D9E144944118DF8D0F78DEA90A78F78D95C650B67D942AB2A0DC0EABB38
B) Materials related to the victim 'Li Daehui'
No. 4 Li Dahui’s investigation report
File pathMeiya_cup/Individual/Report/TaiFai/investigation assistant Li Dahui’s investigation report.pdf
Hash value:
SHA256 C139AB65AC52FE9B3C9E0C7A9F9D6427F2F18FBE3C16585225F6DD01C4D500D2
No. 5 Victim Li Dahui’s mobile phone data
File path Meiya_cup_2022/Individual/Image/TaiFai/VTM_Mobile
Hash value: 092A7379B063A25A82A03EE07EEF1686BE86DD1F73C6E7B007BC26FADCB66555
C) Information related to girlfriend 'Wang Xiaolin'
No. 6 Wang Xiaolin's investigation report
File pathMeiya_cup/Individual/Report/HiuLam/investigation assistant Wang Xiaolin investigation report.pdf
Hash value:
SHA256 5D9FC871259CAC02904947F83C2319E359C7CA916CA657555FF7F41E65A79B8A
Electronic data of No. 7 girlfriend Wang Xiaolin’s mobile phone
File path Meiya_cup_2022/Individual/Image/HiuLam/HiuLam_iphone
Hash value: DB81354712AB1DC2BA01033E48CE97F811C77127A447B0928D83AE77A35C508D
A total of 70 questions in the individual competition
1. [Single-choice question] Which paragraph of text did Wang Xiaolin add a highlight to in this e-book at the end? (2 points)
A. What’s your plan
B. Baoyu has already passed three cups
C. Wu Song After breakfast that day,
D. Just get rid of him and be a strong man.
Analysis: This question is linked with the last question. Romance of the Three Kingdoms ha.
2. [Multiple choice] Wang Xiaolin has a mobile app (Mobile App) of MTR Mobile (Hong Kong) in her mobile phone. Checking the data in its database, Wang Xiaolin added a bookmark to a trip at 22:04 on October 11, 2022. The start and end of this trip include? (2 points) A. Tsim Sha Tsui
B.
Hong Selenium
C. Cannes
D. Tsing Yi
E. Shatian
Analysis: First find the application list and search for the mobile phone program keyword MTR
Find the path where its database is located
3.[Fill in the blank question] How many photos did Wang Xiaolin take with her mobile phone on October 2, 2022? (Answer in Arabic numerals) (1 point) 90 Analysis: First select the timeline, then select the
HEIC
format
4. [Single-choice question] Check Wang Xiaolin’s cell phone photos, where did she go on October 2, 2022? (1 point)
A. Tai Tam Country Trail
B. Shing Mun Pond Path
C. Tai Lam MacLehose Path
D. King’s Park Wylie Path
Analysis: You can locate it according to the latitude and longitude, and you can also see the picture
5. [Single-choice question] Li Dahui is using an LG V10 mobile phone. What is its model? (1 point)
A. LGH960C
B. LGH961N
C. LGH960H
D. LGH961C
E. LGH961D
Analysis: Using Pangushi mobile phone to collect evidence The model can be obtained directly
6. [Single-choice question] What is the most frequently searched category (Category) of Li Dahui’s mobile phone? (1 point)
A. Skin care products
B. Travel
C. Sports
D. School
analysis: Check the search items and directly find the main search is skin care Taste
7.[Fill in the blank question] Li Dahui recently patronized a Meifeng Express company. What is the tracking number of this express delivery? (Do not enter symbols and blanks, answer in Arabic numerals) (1 point) Analysis: No
idea
8. [Single-choice question] There is a phishing link (Phishing Link) in the email Li Dahui received. What is the address of this link? (1 point)
A. None of the above
B. https://bit.ly/ 3yeARcO
C. https://bit.ly/5vM12
D. http://bit.ly/Hell0
Analysis: Find its email database file, find
9. [Single-choice question] Continuing from the previous question, which email address was this email sent from? (1 point)
A. None of the above
B. [email protected]
C. [email protected]
D. 30624700Peter@ Proton.me
analysis: check the database, same as above.
10. [Single-choice question] Continuing from the previous question, what is the IP address that sent this email? (2 points)
A. None of the above
B. 65.54.185.39
C. 10.13.105.56
D. 58.152.110.218
Resolution: In the database The ip was not found, but the corresponding google mail url was found, but the query IP did not match
- [Single-choice question] An orderxlsx file on Li Dahui’s mobile phone is encrypted. What is the decryption key? (1 point)
A. 2022 Nov!
B. 20221101
C. Nov2022!
D. P@sswOrd!
Analysis: Search for the file name, Find the file path, export the file, try to decrypt it with the password in the option, and find that the password Nov2022! is correct.
12.[Fill in the blank] Every street lamp on the streets of Hong Kong has a number. Analyze the program KMB 1933 in Li Dahui's mobile phone. Which street lamp is near the longitude (Latitude) 22.4160270000 and latitude (Longitude) 114.2139450000? What is its number? (Answer in capital letters and Arabic numerals) (2 points) SC02-S-
1100- 0
analysis: find the program database file, and then view and analyze the database file
13. [Fill in the blank question] There is a photo taken by Li Dahui’s mobile phone. The metadata of the photo has been modified. What is the file name of this photo? (
Answer Sub-file name) (2 points)
20220922_152622
Analysis: Only the time of adding and modifying this photo does not match, and the time of shooting was actually in 2008, which was still the era of feature phones Nokia, so there is no smart phone.
14. [Single-choice question] Analyzing the data in Li Dahui’s mobile phone, which company does he work for? (2 points)
A. Meilihao Cosmetics Company
B. Backgammon Trading Company
C. Shanda International Co., Ltd. D. Analysis of
Eternal Cosmetics Company
: Search for the keyword xlsx, find files that may store data, and open them one by one for viewing and analysis.
-
[Fill in the blank question] What is the verification code for Lin Junxi to log in to his Google account with his mobile phone? (Don’t enter symbols, answer with uppercase English and Arabic numerals) (1 point) G-785186 Analysis: You can find it when you find the text message on your
mobile
phone
-
[Fill in the blank] What is the WhatsApp' number of Lin Junxi's mobile phone? (Number)@s.whatsapp.net? (Answer in Arabic numerals) (1 point)
[email protected]
Analysis: Find whatsapp account number
17. [Single-choice question] By analyzing the photos of Lin Junxi’s mobile phone, can you judge where he secretly took pictures of Wang Xiaolin? (1 point)
A. Transportation
B. Country park
C. Swimming pool
D. Hotel room
Analysis: Analysis of whatsapp chat records
18.[Fill in the blank question] Lin Junxi once deleted a photo he took. What is the file name (Filename) of this photo? (Don’t enter, answer with uppercase English and Arabic numerals. For example, Cat10.jpg, you need to answer CAT10JPG)(2 Points)
IMG0444JPG
Analysis: Use the Pangushi mobile phone to collect evidence, and find the most recent deletion.
19.[Fill in the blank] Wang Xiaolin once sent a PDF file to Lin Junxi. What is the file signature (File Signature) of this file? (answer the first eight digits in hexadecimal numbers, such as FOA1C5E1) (2 points) Analysis
of D0CF11E0
:
Find the pdf file attached to the resource file in whatsapp, and find that it cannot be opened directly. After exporting, use xways to open it to view its file signature.
20.[Fill in the blank question] Continuing from the previous question, the PDF file contains the information of a victim who was once shouldered. Analyzing the data of Lin Xi’s mobile phone, what is the English name of the victim? (Do not enter symbols and blanks, answer in uppercase English) (2 points) WONGSAIPING analysis: Enter the name corresponding
to
the last one in the table in the above question find, you can find
21. [Single-choice question] Analyzing the data on Lin Junxi’s mobile phone, where does he plan to go on October 17, 2022? (2 points) A. None of the above
B.
Tsuen Wan Station
C. Shatin Station
D. International Finance Center II Expect
22.[Fill in the blank question] Continuing from the above question, what is the end time of the above itinerary? (If the answer is 1:01:59, answer 160159) (2 points)
23.[Fill in the blank question] In Lin Junxi’s mobile phone, on or after September 1, 2022, which photo was taken by other mobile phones, and what is its file name? (Do not enter, use English and Arabic in capital letters Digital answer. For example, Cat10.jpg, you need to answer CAT10JPG) (2 points)
IMG0445JPG
analysis: find the photo
24. [Single-choice question] According to the photo database Photos.sglite data, which column header (Column Header) can show the receiving method of this photo? (2 points) A. ZRECEIVEMETHODIDENTIFIER B. ZIMPORTEDFROMSOURCEIDENTIFIER
C.
ZIMPORTEDBYBUNDLEIDENTIFIER
D.
ZRECEIVEDFROMIDENTIFIER
analysis : ZIMPORTEDBYBUNDLEIDENTIFIER can be found
-
[Single-choice question] Continuing from the previous question, how did you receive this photo? (2 points)
A. Web page download
B. Bluetooth transmission
C. None of the above
D. WhatsApp software transmission
E. Signal software transmission
analysis: chat history in whatsapp can be seen here.
-
[Fill in the blank] Continuing from the previous question, what is the original filename of this photo? Do not enter it, and answer in uppercase English and Arabic numerals. Such as Cat10, jpg, need to answer CAT10JPG) (3 points)
27. There is a memo (Notes) locked in Lin Junxi’s mobile phone. What is the name of this memo? (Answer in capital letters and Arabic numerals) (1 point)
- [Fill in the blanks] Continuing from the previous question, there is a string of numbers in the above memo, what is it? (Answer in Arabic numerals) (2 points)
29.[Single-choice question] What is the Operating System version of Junxi Lin’s computer? (1 point)
A. Windows 10 Pro for Workstations 21H2
B. Windows 10 Pro 22H2
C. Windows 10 Home 21H2
D. Windows Analysis of 10 Pro for Workstations 21H1
: Take a look at the simulation
- [Fill in the blank question] What brand of virtual private network (Virtual Private Network - VPN) software has been installed on Lin Junzhao's computer? (Do not enter symbols and blanks, answer in uppercase English and Arabic numerals) (1 point) ExpressVPN analysis: Method 1: Install
in
the
path Find ExpressVPN in .
Method 2: Simulate and look at the control panel
- [Fill in the blanks] Continuing from the previous question, analyze the log of the virtual private network. When did he install the virtual private network? (If the answer is 2022-12-29, answer 20221229) (2 points) Analysis
:
method One: Check the log time of the path where it is located.
Method 2: There is time directly in the control panel
-
[Fill in the blank question] Check the data of Lin Junzhao's computer, which Cryptocurrency does he use to pay for virtual private network software? Answer the full name of the cryptocurrency in capital letters, such as BITCOIN) (1 point) pen-special
analysis
: Bit traces can be found in the log
-
[Fill in the blank] What is the name of Junxi Lin’s encrypted loan wallet (ocurrency Wallet)? Do not enter symbols, answer with uppercase English and Arabic numerals for 2 points) tellaw_ieh Analysis: Method 1: Find the wallet name
in
the
log
Method 2: Simulation, open the software to view
-
[Multiple choice] Which browser (Web Browser) is installed in Lin Junxi’s computer? (1 point)
A.Tor Browser
B.Microsoft Edge
C.Google Chrome
D.Opera
E.Internet Explorer
Analysis: Automatic Analysis Using Pangushi Computer Forensics get.
-
[Single-choice question] Which website did Lin Junxi visit the most when using the browser Google Chrome'? (1 point)
A. https://gmail.com
B. https://mail.google.com/mail
C. https: //web.whatsapp.com
D. https://facebook.com
analysis: view history
-
[Multiple choice] In addition to the above websites, what did Lin Junxi use the browser Google Chrome' to search for? (1 point)
A. javascript teaching
B. php sql teaching
C. tor teaching
D. docker image teaching
E. electrum teaching
analysis: search keyword teaching
-
[Single-choice question] Lin Junzhao’s computer is installed with a communication software Signal’, what is the storage path of its user department? (1 point)
A. Users\HEINDesktop Signal
B. Users\HEI\AppData Roaming Signa
C. Program Files (x86 )Signal
D. Users\user Roaming Signal
Analysis: View shortcut file pointing path
-
[Fill in the blank] The communication software Signal uses a file to store the user's chat history. What is its file name? (Don't enter, answer in uppercase English and Arabic numerals. For example, Cat10.jpg, answer CAT10JPG) (2 points) db
. sqlite
analysis: just find the database file
- [Fill in the blank question] Continuing from the above question, analyze the above file, how many of Lin Faxi’s contacts have installed Siqnal? (answer in Arabic numerals) (3 points) 4 Analysis: If you manually analyze the database, the official review said
to
use It is not convenient to disclose the specific details of the password obtained through dynamic tracking. There are a total of 5 people, excluding his own mobile phone number, there are 4 people. American Asia Forensics Master does not support automatic analysis of signals, but Qi Anxin Pangu Stone Computational Forensics supports automatic analysis. I would like to give a thumbs up to Qi Anxin, the first brother of Wangan.
- [Fill in the blank question] Lin Junxi once had a conversation with someone in "Signal', what is that person's mobile phone number? Need to answer together with the area code (3 points in Arabic numerals)
1666257286302
-
[Multiple-choice questions] Continuing from the above question, some messages (Messages) in the conversation between the two people in Signal' contain attachments. The D' of these messages includes? (2 points) A.5b9650fe-3bb6-4182-9900-
f56177003672
B.46a8762b -78ea-49aa-a6f5-b24975ec189f
C.9729bf92-ab9c-45f7-8147-66234296aele
D.47233ffe-1a73-4b3d-b97c-626246ec3129
Analysis: Only those equal to 1 have attachments, and those not equal to 1 are not.
-
[Fill in the blank question] Continuing from the above question, Lin Junxi once accounted for Transfer Money) to the above-mentioned interlocutor on October 20, 2022. What is the reference number of that transaction? (Answer in capital letters and Arabic numerals) (3 points)
N91088774024
Analysis: Find the name of the picture file in the database and check the number.
- [Single-choice question] How many virtual machines (Virtual Machine - VM) are installed in Lin Junzhao's computer? (Answer in Arabic numerals) (1 point) A.4 B.1 C.2
D.3
Analysis
:
Using
Pangushi computer forensic analysis The system can directly find the number of virtual machines.
- [Single-choice question] Where is the virtual machine (VM) stored in Junxi Lin’s computer? (1 point)
A.User HEI Roaming Virtual Machinesl
B.Users Public Documents Virtual Machines
C.Program Files Virtual Machines
D.\Users\HEINDocuments Virtual Machines
analysis: view the corresponding path.
45. [Single-choice question] What version of the operating system (Operating System) does the virtual machine (VM) use? (1 point)
A. CentOs Linux 7.5.1804 (Core)
B. Ubuntu 22.04.1 LTS
C. CentOS Linux release 7.6 .1810(Core)
D. Ubuntu 20.04.5 LTS
analysis: check the system version.
- [Multiple choice] Who are the users of the file transfer server (FTP Server) in the virtual machine (VM)? (2 points) A.
nobody
B. root
C. admin
D. man
E. ftpuser
analysis: view the history of the terminal, Find the corresponding configuration file and continue viewing. Anonymous login is not allowed, and only local account login is allowed.
-
[Multiple-choice questions] What web server (Web Server) is set for the virtual machine? (2 points)
A. NGINX
B. LIGHTPD
C. WORDPRESS
D. APACHE
E. IIS
Analysis: View command history
-
[Single-choice question] There is an image file in the directory of the web server, and where is this file stored? (1 point)
A. /var/www/html/post/src
B. /var/www/html/post/css
C . /var/www/html/post/vendor
D. /var/www/post
analysis: good search method
-
[Single-choice question] Analyze the website data of the web server, what is the company name of the fake website? (1 point)
A. Krick Global Logistics
B. Global Logistics
C. Krick Post Global Logistics
D. Krick Post
Analysis: Look at the logo
-
[Single-choice question] Check the display on the homepage of the fake website, what does AY806369745HK stand for? (1 point)
A. Mail number
B. Mail charge number
C. Mail serial number
D. Mail reference number
Analysis: audit source code
-
[Fill in the blank] Analyze the data on the fake website. When the victim enters the data through the fake website, the website will generate a file. What is its file name? (Do not enter ", answer in capital letters and Arabic numerals. For example, Cat10.jpg , need to answer CAT10JPG) (2 points)
vutxt
analysis: code audit
-
[Multiple-choice questions] Analyze the fake website file, process.php' source code (Source Code), speculate that the purpose of this file may be? (2 points)
A. Change the function
B. Generate a file
C. Send an email
D. Update the database
analysis: Code auditing, writing to files and sending emails. -
[Fill in the blank question] View the source code of the file process.php', what is Lin Junzhao's email password? (answer in capital letters) (1 point)
rtatsceucpacacbdacs
-
[Multiple choice] Analyze the file process.php' source code, what information does it not collect? (2 points)
A. GPS location
B. Credit card number
C. SMS verification code
D. Phone number
E. Email address
Analysis: code audit
-
[Fill in the blank] The virtual machine (VM) has installed the Docker program, and lists a Docker "mirror mage) ID starting with 5 (answer in Arabic numerals and uppercase English) (2 points) 5d58c024174dd06df1c4d41d8d44b485e3080422374971005270588204ca3b82 Analysis: Master
of
Forensics
-
[Fill in the blank] What is the communication port (Port) of Docker container (Container) mysql' open to the outside world? (3 points)
43306
Analysis: View its configuration file
- [Fill in the blank] Docker container mysql, what is the password of user root'? (answer in uppercase English and Arabic numerals) (2 points)
2wsx3edc
analysis: look at historical records, search keyword mysql
- [Fill in the blank] Docker container, which database in mysql stores a lot of personal data? (answer in uppercase English) (3 points)
krickpost
analysis: find and see the content in the database
- [Fill in the blank] View the data in the database in the Docker container 'mysql', what is Li Dahui's date of birth? (If the answer is 2022-12-29, answer 20221229) (3 points) 19850214 Analysis: Query
the
database
- [Multiple-choice questions] Based on the analysis of forensic investigation results (including but not limited to the above questions and circumstances), what kind of crime does Lin Zhao’s behavior involve? (5 points) A.
Delivery of child pornography
B. Robbery
C. Fraud
D. extorting money
E. buying drugs
Analysis: It can be obtained according to the analysis of the case.
-
[Fill in the blank] What is the MEI' number of Wang Xiaolin's mobile phone? (Answer in Arabic numerals) (1 point)
352978115584444
Analysis: Use the Pangushi mobile phone forensics software to obtain it directly.
-
[Multiple-choice questions] What instant messaging software (lnstant Messaging Apps) is installed on Wang Xiaolin’s mobile phone? (1 point)
A. Signal
B. WeChat (WeChat)
C. QQ
D. WhatsApp
E. LINE
Analysis: Honglian Huoyan finds the result directly .
-
[Single-choice question] On what day and time did Wang Xiaolin send a PDF file through instant messaging software? (Answer in time zone UTC+8) (1 point) A.2022-09-30
17:39:53
B.2022-10 -01 17:39:53
C. 2022-09-30 18:30:28
D. 2022-10-01 16:30:22
Analysis: View whatsapp chat history.
-
[Fill in the blank question] Continuing from the previous question, what is the MD5 hash value (Hash Value) of this PDF file? (Answer in uppercase English and Arabic numerals) (1 point) AE0D6735BBE45B0B8F1AB7838623D9C8
Analysis
: Calculate the hash value
-
[Single-choice question] Which user did Wang Xiaolin send this "PDF file to, and what is the user's mobile phone number?" (1 point) A.85297663607 B.85259308538
C.85269707307
D.85246427813
Analysis
:
Check the chat software to find 85259308538
-
[Multiple-choice questions] What is the reason why Wang Xiaolin sent this PDF file? (1 point)
A. Ask for help
B. Share the content of the file
C. Sent by mistake
D. Unable to open
Analysis: Case analysis based on chat records -
[Single-choice question] Continuing from the previous question, analyze the conversation between Wang Xiaolin and the above user. What is their relationship? (1 point)
A. Customer
B. Teacher and student
C. Family member
D. Colleague
Analysis: According to the chat records, it is a colleague
68.[Single-choice question] When did Wang Xiaolin ask the above user to delete a photo? (1 point)
A. 2022-10-06
B. 2022-09-28
C. 2022-09-30
D. 2022-10-03
Analysis: case analysis
69.[Single-choice question] Continuing from the previous question, what request did the user ask Wang Xiaolin to delete this photo? (1 point)
A. Money
B. Drugs
C. Sexual services
D. Encrypted currency
Analysis: chat record analysis
70. [Single-choice question] What is the Electronic Book in Wang Xiaolin’s mobile phone? (2 points)
A. Romance of the Three Kingdoms
B. A Dream of Red Mansions
C. Outlaws of the Marsh
D.
Analysis of Journey to the West: Search BOOK, check the plist file of iBOOK analyze.