Apples and flags: Telling the Story of an iPhone
Part 1 of the Magnet Virtual Summit CTF 2025!
Hello everyone, this is the beginning of my writeup of the Magnet Virtual Summit 2025 CTF. This was a digital forensics CTF that took place alongside MVS 2025 starting on February 13, 2025. It technically lasted until February 28th, although the first person finished on the 21st and began writing it up then. As such this writeup will take into account what I finished before that time/what I had intuitions on before that time, A user named andro6 was the first to finish. You can see their finishing time below,
Without further ado, the challenges.
I managed to finish all but the final three before filling in the remainders after write-ups.
Peak Performance
5
What version of IOS is on this iPhone?
Easy first challenge. Found in /private/var/installd/Library/MobileInstallation/LastBuildInfo.plist
18.0
Connect The Digits
5
What is the device's phone number?
I ran the device image through iLEAPP and received this in the report home.
18024959063
In The Name of Friendship
5
What was the contact name stored on 2024-11-13 5:45:05.000 PM?
The first thing I checked after the device report were the text messages. This revealed that the characters are named Ruth and Mary. I guessed that the other character is named Mary. I verified this by looking at the iLEAPP contacts.
Mary
Correct Me If I'm Wrong..
10
How many words typed were autocorrected?
I took a great many guesses and the following was the correct guess
52
Where Are We Meeting?
10
What time did ruth plan to meet Mary at Black Cap?
2:15
The Root of The Problem
10
What color hair does Ruth's Bitmoji have?
When I was solving, I didn’t know where to find Bitmojis, whether it was in Snapchat’s regular or Shared container (/private/var/mobile/Containers/Data/Applications/data/… or /private/var/mobile/Containers/Shared/AppGroup…) and found a picture that looked vaguely like a bitmoji. It had blonde hair. That was a correct guess.
blonde
Artifically Crafted Designs
10
What was the first AI tool installed on the device?
There are many applications stored on this iPhone, some of them contain AI features. One such app is Canva. Another is ChatGPT. Others are Instagram, SnapChat and the Adobe apps. After guessing a few times, Canva came out as the right answer.
Canva
Tracing The Envelope
10
What was the IP address logged from Discord?
This answer was found in an email. There is an inbox in the Google Takeout section that makes this email address easily able to be seen. The email can also be seen in iLEAPP.
184.171.159.153
Where's Nashville?
10
What is the Latitude of Nashville in the Weather App? Format: xx.xxxxxxx
For this piece of data, look into the “Weather Location Data” section of iLEAPP.
36.1660667
Important FACTor
25
What is the answer to second the equation in notes?
This data is located in the notes shared data location in the file
/private/var/mobile/Containers/Shared/AppGroup/48006795-907F-4242-865D-11B66F78AC1E/Accounts/33B1E6A9-7C30-4484-87BD-7FD94A727DA5/Previews/34796591-0283-4420-BC80-E723A5E227C8-1-768x768-1/30_41A8595A-9755-420D-8BE4-1484BB29FB4B/Preview.png
432
The Ghost That Couldn't Speak
25
What app was denied permission to use Microphone?
iLEAPP came in handy for this challenge as well. I didn’t remember at the top of my head where this evidence was located. It was located in /private/var/mobile/Library/TCC/TCC.db
com.toyopagroup.picaboo
The Sale Before the Sale
25
If Ruth bought an item for $40 or more, she gets her second one 40% off with what code?
This piece of evidence would be in /private/var/mobile/Library/SMS/sms.db.
It is within a text message
EARLYBF24
TikTok on the Clock
25
In YYYY-MM-DD HH:MM:SS format, when was the tiktok video posted?
2024-11-12 22:11:09
Directional Navigation
25
What beach was searched for?
Again, in the text messages, we find records of a North Beach.
North Beach
SERIALously Old!
25
Using format YYYY-MM, When was this device purchased?
Find this in the iLEAPP about page.
Grab the serial number and past it into https://checkcoverage.apple.com/coverageThis shows the correct format is:
2022-12
Artists write their names on the CANVAs
25
Who is the author of the October 2023 wallpaper?
Look at the Safari history, either in the History .db under /private/var/mobile/Library/Safari or in the appropriate iLEAPP page. You find the following link
nikkivegan
Finding Your Grounds
50
(x2 Guesses)
What popular coffee company did Ruth get coffee from?
[From Andro6 Writeup]
The text messaging in iLEAPP shows that there is a place called black cap coffee. They get their fix of coffee there. I originally misread the question and wasted all of my guesses.
Dunkin’
The SPIRITs are among us
75
What link redirects you to apply for a job?
[Not found on my playing through by myself, I took a hint to find it.]
I did not originally find the picture in this section. I thought first of Snapchat, nothing was there. I then tried to find Spirit Halloween in deleted web history. Nothing was there. I was told to look in the Live Photo and it worked out.
https://delivr.com/2fsmr-qr
Dead Portrait Society
75
When was the last written record created? (format YYYY-MM-DD HH:MM:SS)
[I did not find this one on my own. I used the Andro6 writeup for help.]
I’m guessing that Written Records are either metadata of files or actual records in writing, I tried things from both categories and was not able to find what the correct answer was. Written records seem to deal with photos and other media. According to Andro6’s writeup, this piece of evidence is found in the PPSQLDatabase.db file that lives within the /private/var/mobile/Library/Personalization/Portrait/ directory.
I found this challenge interesting because I have never dealt with this type of evidence before. I showed me a new place to look and that is awesome!
The timestamp that is associated with the answer is a raw Mac timestamp: 1732132922.92298. The picture below shows it in context.
When converted to a human-readable date, it converts to: 2024-11-20 20:02:02
2024-11-20 20:02:02
My two biggest takeaways form this section are learning about the records databases and learning the lesson to always look closer at evidence. I missed an easy 75 points on the Spirit Halloween on at first, which I wish I would have caught when the bragging righhts were still on.
The other five sections will be split into Chromebook, Windows, Android and Google Takeout (Both Android and Chromebook combined.
I hope you enjoyed this first post and I look forward to delivering my writeup of everything else. Until next time, Matt out!