Silent Witness - Digital Forensics CTF Writeup

cyberakhhbar9

Challenge Overview
Category: Digital Forensics / Steganography

Difficulty: Medium

Target Artifacts: activity.log, gps.csv, phone_backup.zip, final.jpg

Objective: Track down the suspect’s activity, locate the final meeting coordinates, and recover the flag.

Step 1: Initial Artifact Inspection
We start by listing and inspecting the downloaded challenge files:
![Initial Artifact Inspection] (https://github.com/user-attachments/assets/77111e63-6d34-4378-b117-9421b7470208)

Bash
ls -la
We obtain four key artifacts:

activity.log – A schedule log detailing daily events.

gps.csv – A CSV file containing timestamped GPS coordinates.

phone_backup.zip – An archive containing mobile device backup data.

final.jpg – An image file likely holding the final hidden secret.

Checking activity.log:

Bash
cat activity.log
Output:

Plaintext
10:00 Office
12:00 Interview
14:00 Meeting Pranav Pandit
15:00 Signal Lost
Checking gps.csv:

Bash
cat gps.csv
We see continuous GPS coordinates linked to timestamps, with 14:00 logging the coordinates 21.1458, 79.0882.

Step 2: Analyzing the Phone Backup
Next, we unpack phone_backup.zip:

Bash
unzip phone_backup.zip -d phone_backup
The extracted folder contains three files:

contacts.vcf

suspect.jpg

chats.db
Unzipped Backup Files

Examining Contacts & Chat History
Reading contacts.vcf:

Bash
cat phone_backup/contacts.vcf
FN: Pranav Pandit

TEL: +91 987654321

Querying the SQLite database (chats.db):

Bash
sqlite3 phone_backup/chats.db “SELECT * FROM messages;”
Output:

Step 3: Steganography Analysis on suspect.jpg
We attempt to extract hidden data from suspect.jpg using stegseek with the rockyou.txt wordlist:

Bash
stegseek phone_backup/suspect.jpg /usr/share/wordlists/rockyou.txt
Output:

Plaintext
Found passphrase: “raven”
Original filename: “note.txt”
Extracting to “suspect.jpg.out”
Reading the extracted note (suspect.jpg.out):

Bash
cat suspect.jpg.out
Output:

Plaintext
Meeting location confirmed.
Password: raven

Step 4: Cracking final.jpg & Flag Recovery
Using the extracted passphrase (raven), we run steghide on final.jpg:

Bash
steghide extract -sf final.jpg -p raven
This extracts clue.txt:

Bash
cat clue.txt
Output:

Plaintext
Last meeting:
21.1458,79.0882
Cross-referencing 21.1458,79.0882 with our earlier gps.csv and activity.log analysis verifies the meeting at 14:00 with Pranav Pandit.

Flag
Formatting the extracted coordinates into the platform’s required syntax gives the final flag:

Plaintext
HackCTF{21.1458_79.0882}