Digital Forensics Challenge 2021 Writeup (302 — User Behavior Analysis)

Instructions

Description
The image.ad1 is an image file of a virtual machine stored in Laptop of the ticket scalper. All files created by the ticket scalper for ticketing are stored in the Download folder. Answer the following questions by analyzing forensic artifacts stored in the image. (Note, the basis for your judgement must be detailed.)
Questions
1. What is the macro file that the ticket scalper used for ticketing? (25 points)
2. What program did the ticket scalper use for the ticketing? (25 points)
3. What program did the ticket scalper use to edit the macro file? (125 points)
4. When did the ticket scalper execute the macro? (50 points)
5. What web browser(s) did the ticket scalper use to run the macro? (75 points)
File Given
image.ad1

Tool Used

AccessData FTK Imager and DB Browser for SQLite are the tools that will be used to answer this problem.

Answer

The description tells us that all files created by ticket scalper for ticketing are stored in the Download folder. This information can help us to answer the first question. So, macro file that the ticket scalper used for ticketing must be in Download folder. We just need to focus on Download folder.

Figure 1. Image file image.ad1 opened using AccessData FTK Imager.
Figure 2. Files stored in Downloads folder.
Figure 3. Files stored in PUBG-Macro-Assist-Master folder.
Figure 4. Files stored in outOfDateEdition subfolder in PUBG-Macro-Assist-Master folder.
Figure 5. Content of dfc_concert.ahk.
Figure 6. Activity table filtered with ‘dfc_concert.ahk’ on AppActivityId column from ActivitiesCache.db opened using DB Browser for SQLite.
Figure 7. Activity table filtered with ‘dfc_concert.ahk’ on AppActivityId column from ActivitiesCache.db opened using DB Browser for SQLite.
Figure 8. Activity table filtered with ‘<=1618801334’ on StartTime column and ‘>=1618801334’ on EndTime column from ActivitiesCache.db opened using DB Browser for SQLite.

Summary:

1. The macro file that ticket scalper used for ticketing is dfc_concert.ahk.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Williams Kosasi

Williams Kosasi

15 Followers

I have so much interest in DFIR and love any challenge that is given to me.