Having fun while learning about and pivoting into the world of DFIR.
by ogmini
Continuing with my writeups on my “fails” or the ones I just couldn’t figure out in the timeframe alloted. I want to talk about how I went about trying to solve the challenge and where I went wrong. This should help me in the future by highlighting weaknesses and areas for improvement. Each post will focus on just one “fail” challenge. You can find all my writeups here.
Title: Dead Portrait Society
Description: When was the last written record created?
This challenge was under the iOS section and worth 75 points making it the hardest challenge in the section. It was so difficult, I didn’t even know where to begin with this one. I decided not to devote much time to this one as I wanted to solve other more obvious challenges.
The hint of “Portrait” was supposed to guide you into finding the “PersonalizationPortrait” database or “PPSQLDatabase.db”. I found a writeup at the following link about this artifact after the solution was posted:
Checking this database for the last written record would give you the relevant timestamp of 2024–11–20 20:02:02.