Magnet Virtual Summit 2025 CTF - Android Takeout


Evidence Link: takeout-20241214T082121Z-001.zip

Deadpool? - 5 points

Question: When was the Mint Mobile advertisement watched? YYYY-MM-DD HH:MM:SS EST

A keyword search across the folder for “mint mobile” leads us to MyActivity for YouTube at path:


\Takeout\My Activity\YouTube\MyActivity.html


The timestamp was 2024:11:06 12:01:21 EST.


Figure 1: Mint Mobile video from YouTube activity

You use your birth year in your email?

Question: What is this user’s email address? _____@_.

Account information can be found in the subscriber information file at path:


\Takeout\Google Account\chickadeemary2000.SubscriberInfo.html


The email address was chickadeemary2000@gmail.com.


Figure 2: Subscriber information

Best job I ever had - 5 points

Question: When was the Senior Marketing Associate job started? YYYY-MM

If you keyword search for “senior marketing associate” we get some hits in email but we also get a hit on an attachment. The attachment was Mary’s resume. If we view it we see she started the position on 2023-02.


Figure 3: Mary’s resume

Tryhard - 5 points

Question: What was this user’s GPA?

Mary had her resume in Google Drive which can be found at path:


Takeout\Drive\Jones_Resume2024.docx


If we open it we see her GPA was 4.0.


Figure 4: Mary’s resume and GPA

I NEED MORE COFFEE!!! - 5 points

Question: What are the geographical coordinates of the coffee shop searched? LAT, LON

In the MyActivity for Maps there was a search for “black cap” which if the link is clicked leads you to Black Cap Coffee & Bakery results that had a latitude and longitude of 44.4444824,-72.9058967.


Figure 5: black cap search in Maps


Figure 6: Lat/Long for the search

That's not very nice of you - 5 points

Question: What is the secret message found in an important file?

This is a file found in Google Drive called important.docx. If you open it all it says is “ihateruth”.


Figure 7: important.docx

Getting Healthy - 5 points

Question: What fitness membership did this user join?

There only appeared to be one option here since there were plenty of Fitbit artifacts.


Figure 8: Fitbit folder


I believe some of these items wouldn’t show or wouldn’t be tracked if they didn’t have a premium membership.

Take Cover! - 5 points

Question: What storm was viewed in the user’s feed on 2024-09-24?

Google Discover is a customized feed that a user could look at. There are MyActivity reports for Discover at path:

\Takeout\My Activity\Discover\MyActivity.html


If we open the file we see there was a card for Hurricane Helene.


Figure 9: Discover card MyActivity

I think this IS LAND?

Question: What was the closest trail to the picture of a body of water?

Google Photos can be found at the path:


\Takeout\Google Photos\Photos from 2024


There is one picture that features water with the file name PXL_20241112_030013300.jpg.


Figure 10: PXL_20241112_030013300.jpg in Google Photos


There are also associated JSON files in the same folder that contains metadata and EXIF of each photo.


Figure 11: PXL_20241112_030013300.jpg.json


If we go to the coordinates in Google Maps we see that it is right next to Island Line Trail.


Figure 12: Coordinates in Google Maps

Flashbang - 10 points

Question: What is the switch on the bottom left of the "About ______" website for?

In the MyActivity for Google Analytics there was a visit to a link to aboutchromebooks.com.


Figure 13: MyActivity entry via AXIOM


If you look at the bottom left after visiting the URL you see a button that toggles Dark Mode.


Figure 14: Dark Mode toggle on aboutchromebooks.com

Never miss a day - 25 points

Question: What was the answer to the game played on 2024-11-15?

In MyActivity there was a visited entry for the game Wordle.


Figure 15: MyActivity for Wordle


If you Google the answer for that day we see it was TACKY.


Figure 16: Wordle answer