Hi, all! This is Jessica Hyde and I am so excited to share the winners from the Magnet Virtual Summit 2025 CTF, the challenges, community write-ups, and the questions! The Magnet Virtual Summit 2025 CTF was another exciting competition. We had over 1742 people register for the CTF and 578 folks solved at least one question!
We’re happy to announce the winners:
- First place: Erik Kwan
- Second Place: Robert Greavu
- Third Place: Gerald
- First Place Team: X
- X
- Immovable
- lkldev
- QmAxZlkldev
And as always, we kept the game open for a First to Finish winner. This is the first player to get a perfect score which happened 9 days after the start of the game. This year’s challenge had more image files, more questions, and admittedly harder challenges.
- First to Finish: Andro6
Figure 1: Scoreboard showing CTF when it closed.
We want to give you the opportunity to keep working through the challenges, so we’re sharing the questions and links to the images below in addition to links to community solves.
Images
Still Need a Copy of the Forensic Images? We are happy to have released an iOS 18 Full File System image as part of this data set as well as an Android 14 image, Windows 11 and Chromebook image. There are plenty to explore in these data sets beyond the CTF itself. Download these images via the NIST CFReDS website.
Questions
| Challenge Name | Question |
| Cipher Challenge | |
| Dressing, with a dash. of 17 spices | Decode the secret message: https://drive.google.com/file/d/1UuqI4YZDbvZcieXE4-t5BhEqiPHsGkIC/view?usp=drive_link |
| Capital offense | Decode the secret message: https://drive.google.com/file/d/1rHVdGqnFrzsBS_CGeYxiU8h5wgzD5GF8/view |
| Knock knock! | Decode the secret message: https://drive.google.com/file/d/1VlZBk0Km9kgTErv6wrR9Dc639whWjfQU/view?usp=sharing |
| Pigs in a blanket | Decode the secret message: https://drive.google.com/file/d/1OcVPHDMExp3CHUcwMr9vEFHeCcD3lJls/view |
| The masked singer | Who is the singer? https://drive.google.com/file/d/1Frvat5jrnWeqP-MwOb-ZIWF3RSFOLN6g/view?usp=drive_link |
| 100x Scale! | Decode the secret message: https://drive.google.com/file/d/13gCPL1jy73mudo7Se3Xy-ZptGUjUkJci/view?usp=drive_link |
| Hidden Spirits | Decode the secret message: https://drive.google.com/file/d/1p4HHKDdSkbROm85c9pxbi7apJTXM_ND9/view?usp=drive_link |
| iOS | |
| Peak Performance | What version of iOS? |
| Connect the Digits | What is the device’s phone number? |
| Important FACTor | What is the answer to second the equation in notes? |
| In The Name of Friendship | What was the contact name stored on 2024-11-13 5:45:05.000 PM |
| Call me, Maybe | Out of all the incoming calls, how many were answered? |
| Stepping Short of a Mile | What was the most steps Ruth did on a day? |
| On a Fraction of the Earth | What time zone is set for the device? |
| Correct Me If I’m Wrong.. | How many words typed were autocorrected? |
| Where Are We Meeting? | What time did Ruth plan to meet Mary at Black Cap? |
| The Root of The Problem | What color hair does Ruth’s Bitmoji have? |
| Artifically Crafted Designs | What was the first AI tool installed on the device? |
| Where’s Nashville? | What is the Latitude of Nashville in the Weather App? |
| Tracing The Envelope | What was the IP address logged from Discord? |
| The Ghost That Couldn’t Speak | What app was denied permission to use Microphone? |
| The Sale Before the Sale | If Ruth bought an item for $40 or more, she gets her second one 40% off with what code? |
| TikTok on the Clock | In YYYY-MM-DD HH:MM:SS format, when was the tiktok video posted? |
| Directional Navigation | What beach was searched for? |
| SERIALously Old! | Using format YYYY-MM, When was this device purchased? |
| Artists write their names on the CANVAs | Who is the author of the October 2023 wallpaper? |
| Trick or Treat | What’s the total operating time on Halloween? |
| Finding Your Grounds | What popular coffee company did Ruth get coffee from? |
| The SPIRITs are among us | What link redirects you to apply for a job? |
| Dead Portrait Society | When was the last written record created? (format YYYY-MM-DD HH:MM:SS.SSSSSS) |
| Android | |
| Thats a lot | What animal was in the TikTok sent via text |
| When you C it | What was the name of the geocacheing app used |
| Finding a good book | What location was the user looking for on 2024-11-11 at 2:46:10 PM UTC |
| Get in Contact | What is the users TikTok username |
| Highspeed Internet | What was the SIM display name |
| Some Connections | What device did the user connect to on 2024-11-05 |
| The Era of pop stars | What song was the user listening to on 2024-11-30 at 8:45:00 AM |
| Get Educated | What degree does Mary have |
| That would look good in a Frame | What is the name of Structure seen in the picture taken at night |
| I love Natur | What language was the nature website in |
| Wearing out your SNEAKERS | Who congratulated Mary on walking 10,000 steps |
| Striking Some Keys | What singer appeared in a TikTok video watched on 2024-11-15 at 1:01:26 AM UTC |
| Thats ICONic | What is the hex code for the Profile Picture with the number (802) 495-9063 |
| Lets Get Famous | How many followers does Mary have on TikTok |
| YOU Watch a Lot of Videos | What’s the rating for the app with the most installs? |
| Would you like an extended warranty? | How many spam numbers were created on 2024-11-27 at 02:42:52.972 UTC? |
| Android Takeout | |
| Deadpool? | When was the Mint Mobile advertisement watched? YYYY-MM-DD HH:MM:SS EST |
| You use your birth year in your email? | What is this user’s email address? (_____@____.___) |
| Best job I ever had | When was the Senior Marketing Associate job started? YYYY-MM |
| Tryhard | What was this users GPA? |
| I NEED MORE COFFEE! | What are the geographical coordinates of the coffee shop searched? LAT, LON |
| Thats not very nice of you | What is the secret message found in an important file? |
| Getting Healthy | What fitness membership did this user join? |
| Weekly Cycle | What day of the week did the user join this membership? |
| Take cover! | What storm was viewed in the users feed on 2024-9-24? |
| I think this IS LAND? | What was the closest trail to the picture of a body of water? |
| Never miss a day | What was the answer to the game played on 2024-11-15? |
| Flashbang | What is the switch on the bottom left of the “About ____” website for? |
| Chromebook | |
| Plugging away | What was the most recent battery level recorded by the Chromebook? |
| Verified by professionals | What is the vendor ID for the touchpad? |
| Feeling: Connected | What was the ip address of the Chromebook? |
| Mirror, mirror on the wall | What is the MD5 hash of Ruth’s avatar picture? |
| You used to call me on my cell phone | What number is stored in contacts? |
| Just five more minutes | How was the device most commonly woken up? |
| They’ll hire anyone these days | How many months was Mary employed with her company? |
| A dip in website traffic | When did the user first interact with a fanfiction website? (UTC) Format: YYYY-MM-DD HH:MM:SS |
| I got logged out | What string was autofilled the most? |
| I definitely need new shoes | What is the size of Ruth’s advertisement in bytes? |
| A for Anonymous | What TV show does Ruth have an interest in? |
| #KRISPy-kreme | What is the version of the noise suppression software? |
| The start of an addiction | When was a game installed on the system? (UTC) |
| You’re so predictable | What is the ID of the URL with the most number of hits? |
| IOC approved | What is the name of the current champion of the sport Ruth was trying to learn? |
| The Devils are pretty good this year | What region had the lowest latency for discord? |
| All of my work is gone! | How many shirts are in the ad? |
| Chromebook | |
| Taking a break | How many emails were in the inbox at 2024-11-19, 12:21:26 EST? |
| Boorrriiiinnggg | What was searched 2024-11-12, 20:17:13 EST? |
| Drive those ads away | What was the model of the Kia in the advertisement? |
| Friends or Foe? | Who did this user communicate with most frequently? |
| Nice kicks | What is the name of the shoes created? |
| Your shirt your way | What was the name of the shirt company? |
| Shoe will have fun with this one | What is the shoe image named with file extension? |
| Identify yourself! | What is the account user ID? |
| Back in my day | What was the user’s birthday? YYYY-MM-DD |
| King Town | What was the last app installed from the play store? |
| Cat Nap | How long is the video watched on 2024-11-17 10:04:45 PM EST? Format: MM:SS |
| I need your approval | Who was the user’s boss? |
| Help I dont want to work! | What was the marketing website used after the shameless search? |
| Stranger Danger | What was the IP address attached to the sketchy email address? |
| Wandering Around | At the following time 2024-09-26 21:21:03 what was the geo location of this user’s IP Address? (Country, State, City) |
| Windows | |
| whoami? | What is the SID for the user “chick”? |
| Goodbye! | When was the last logoff time for the user “chick”? |
| In the Zone | What is the host URL that crow.jpg was downloaded from? |
| I rate it 4 out of 10 | What was the username of the person who saw the clouds coming in at 6:30 while doing a geocache? |
| Sweet Find | What popular game was installed on the computer? |
| Buried Treasure | On what social media platform did Mary look at a Burlington news account? |
| Follow the Thread | Where did Mary look for help with her coding questions? |
| Venomous Variables | What language was Marys first program written in? |
| Account Registration | What is the creation date for Marys user account? |
| It’s History Now | What was the name of the geocache that was completed? |
| Where did it go? | What file was an anti-forensics tool used on? |
| Used by only the PROs | What email service is Mary using other than gmail? |
| If you don’t choose, I’ll choose for you | What is the default browser set as? |
| A Stamped Link | What time was the tiktok that Mary watched posted (YYYY-MM-DD HH:MM:SS)? |
| Unravel the Mystery | What was the suggestion count when Mary was going to play a popular word-based browser game? |
| Login Credentials Required | What is Mary’s username on geocaching.com? |
| A Shadow of the Real Thing | What is the hashed password for the user “chick”? |
| Out of the Ordinary | What suspicious command line tool was installed on Marys system? |
| DAdataTA | What does the file sucess.txt.txt contain? |
Solutions
Several folks have shared their solutions for this year’s MVS CTF. Love when people share their methods. Check them out to see how others solved the challenges. There is often more than one way to solve the challenges!
- First to finish winner, Andro6, walks through their solves on their blog
- Doug Metz shared his solves on his Baker Street Forensics site
- Kevin Pagano on his blog Stark4n6 and the Hexordia blog.
- Kaung Zawhein also shares his solves here.
- Christopher E. wrote up both his pre-analysis before the contest and is now writing posts on how to solve individual challenges.
Thank You!
Thank you so much for playing! As always a big shout out to the amazing Hexordia team that built the CTF including Kevin Pagano who took it seriously when I requested we author harder questions and our amazing interns Yehuda Bollen, Fatima Omorevic, Adam Hachem, James Cangelosi, Cece Ehgotz, and Nathan Kreit from the Champlain Digital Forensics Association for working with us to build this incredibly fun challenge for the community!
The post Announcing the Winners of the 2025 Magnet Virtual Summit CTF appeared first on Magnet Forensics.