Ordiphone 0

forensics memory android FCSC 2021 solved on

star star

Description

A new apprentice has just taken a memory dump but forgot when the capture was initiated. To validate this first step, find the date on which the capture process has been started.

Note: the flag follows the format FCSC{sha256(date)}, with the date in the format YYYY-MM-DD HH:MM in UTC.

This challenge has been split into three parts:

Files

  • lime.dump.tar.xz
    190.89 MiB – 541a053764d1b5f4c905de8fde2c3b42b9bf51467afb453e8422ccaa5ae4634c

Author

\E

Flag

Share my success on Fediverse, Twitter, Linkedin, Facebook, or via email.

Submit your solution

You can submit your writeup for this challenge. Read the FAQ to learn how to proceed.

You need to be logged in to submit a writeup.

Writeups

I've been looking for a long time and I still can't find the flag!

You can vote for the solutions you prefer by using the on their respective pages.

DateAuthor Language Tags Vote
2023-11-07
naacbin
🇬🇧
TeamFrance