Evidence Link: takeout-20241214T082121Z-001.zip
Deadpool? - 5 points
Question: When was the Mint Mobile advertisement watched? YYYY-MM-DD HH:MM:SS EST
A keyword search across the folder for “mint mobile” leads us to MyActivity for YouTube at path:
\Takeout\My Activity\YouTube\MyActivity.html
The timestamp was 2024:11:06 12:01:21 EST.
Figure 1: Mint Mobile video from YouTube activity
You use your birth year in your email?
Question: What is this user’s email address? _____@_.
Account information can be found in the subscriber information file at path:
\Takeout\Google Account\chickadeemary2000.SubscriberInfo.html
The email address was chickadeemary2000@gmail.com.
Figure 2: Subscriber information
Best job I ever had - 5 points
Question: When was the Senior Marketing Associate job started? YYYY-MM
If you keyword search for “senior marketing associate” we get some hits in email but we also get a hit on an attachment. The attachment was Mary’s resume. If we view it we see she started the position on 2023-02.
Figure 3: Mary’s resume
Tryhard - 5 points
Question: What was this user’s GPA?
Mary had her resume in Google Drive which can be found at path:
Takeout\Drive\Jones_Resume2024.docx
If we open it we see her GPA was 4.0.
Figure 4: Mary’s resume and GPA
I NEED MORE COFFEE!!! - 5 points
Question: What are the geographical coordinates of the coffee shop searched? LAT, LON
In the MyActivity for Maps there was a search for “black cap” which if the link is clicked leads you to Black Cap Coffee & Bakery results that had a latitude and longitude of 44.4444824,-72.9058967.
Figure 5: black cap search in Maps
Figure 6: Lat/Long for the search
That's not very nice of you - 5 points
Question: What is the secret message found in an important file?
This is a file found in Google Drive called important.docx. If you open it all it says is “ihateruth”.
Figure 7: important.docx
Getting Healthy - 5 points
Question: What fitness membership did this user join?
There only appeared to be one option here since there were plenty of Fitbit artifacts.
Figure 8: Fitbit folder
I believe some of these items wouldn’t show or wouldn’t be tracked if they didn’t have a premium membership.
Take Cover! - 5 points
Question: What storm was viewed in the user’s feed on 2024-09-24?
Google Discover is a customized feed that a user could look at. There are MyActivity reports for Discover at path:
\Takeout\My Activity\Discover\MyActivity.html
If we open the file we see there was a card for Hurricane Helene.
Figure 9: Discover card MyActivity
I think this IS LAND?
Question: What was the closest trail to the picture of a body of water?
Google Photos can be found at the path:
\Takeout\Google Photos\Photos from 2024
There is one picture that features water with the file name PXL_20241112_030013300.jpg.
Figure 10: PXL_20241112_030013300.jpg in Google Photos
There are also associated JSON files in the same folder that contains metadata and EXIF of each photo.
Figure 11: PXL_20241112_030013300.jpg.json
If we go to the coordinates in Google Maps we see that it is right next to Island Line Trail.
Figure 12: Coordinates in Google Maps
Flashbang - 10 points
Question: What is the switch on the bottom left of the "About ______" website for?
In the MyActivity for Google Analytics there was a visit to a link to aboutchromebooks.com.
Figure 13: MyActivity entry via AXIOM
If you look at the bottom left after visiting the URL you see a button that toggles Dark Mode.
Figure 14: Dark Mode toggle on aboutchromebooks.com
Never miss a day - 25 points
Question: What was the answer to the game played on 2024-11-15?
In MyActivity there was a visited entry for the game Wordle.
Figure 15: MyActivity for Wordle
If you Google the answer for that day we see it was TACKY.
Figure 16: Wordle answer