F 230: iPhone Analysis with Autopsy (20 pts)

What You Need for This Project

Purpose

To analyze data from an iPhone with Autopsy.

Launch your Windows Analysis Machine

Launch the Windows machine you use, with Autopsy on it.

Installing 7-Zip

On your Windows analysis machine, if you don't have 7-Zip, get it here:

https://7-zip.org

Downloading the Evidence File

In a Web browser,open this page:

https://downloads.digitalcorpora.org/corpora/scenarios/magnet/

Download the "2021 CTF - iOS.zip" file, highlighted in the image below.

Installing Hashcalc

On your Windows analysis machine, if you don't have Hashcalc, get it here:

https://www.slavasoft.com/download.htm

Verifying the Hash Value

Calculate the SHA-256 hash of the "2021 CTF - iOS.zip" file. Verify that it matches the image below.

Unzipping the Data

Right-click the "2021 CTF - iOS.zip" file and click 7-Zip, "Extract to "2021 CTF - iOS\"".

Analyzing the iPhone Data with Autopsy

Launch Autopsy.

Creating a New Case

From the Autopsy menu bar, click the "New Case" button.

Enter a Case Name of iPhone.

Click the Next button.

Click the Finish button.

Importing the iPhone Data

In the Add Data Source, at step 1. Select Host, click the Next button.

At step 2. Select Data Source Type, click "Logical Files".

Click the Next button.

At step 3. Select Data Source, click the Add button. Navigate to your desktop. Click the "2021 CTF - iOS" folder and click Select.

Click the Next button.

At step 4. Configure Ingest, clear all the boxes except "iOS Analyzer (aLEAPP)", as shown below.

Click the Next button.

At step 5. Add Data Source, click the Finish button.

Examining the Evidence

In the left pane of Autopsy, in the "Data Artifacts" section, useful data from the iPhone appears, including Phone calls, Messages, and Web searches, as shown below.

F 230.1: Phone Number (5 pts)

Find the phone number in the 541 area code, covered by a green rectangle in the image below. That's the flag.

F 230.2: Latitude (5 pts)

Examining the GPS data, what was the most northern latitude of the phone?

F 230.3: SMS (5 pts)

Examining the Messages, what code did SIGNAL send the phone?

F 230.4: Signal Contact (5 pts)

Examining the Program Notifications, find the person named Johnathan who sent Snapchat (also called pikaboo) messages to this phone.

What is that person's last name? That's the flag.

Posted 10-7-22
F 230.4 description fixed 11-5-22
References to Android removed 11-12-22