Warm Up
What Southern state’s sports team did Rocco search up? (STATE ONLY)
In Axiom > Web Related > Chrome Keyword Search Terms, “ragin cajuns football roster” is on the list. In America, we consider football a sport. (We also consider soccer a sport, but use the proper names.)
Google “ragin cajuns”, and discover they’re from Louisiana
Flag: Louisiana
Can you Handle this
What was Rocco’s Twitter account name?
Under Axiom > Social Networking > Twitter Users > saw “rocco” in one of the User Names and used good old fashioned guessing
Flag: RoccoSachs96775
Need to reach those heights
What is the SIM operator name?
I’ve learned that Firing up ALEAPP is great for this type of information.
Under Device Info > SIM_INFO_0, I see
Flag: Boost Mobile
Not to be basic but…
What is the default Internet Browser?
Again ALEAPP is our friend here. ALEAPP > Browser Cache
Just 2 browsers listed and limited at 3 attempts. I like those odds. Given that it’s an Android phone, let’s start with the obvious.
Flag: Chrome
Survival Mode Activated
What conference did Rocco show interest in?
Let’s head back to AXIOM > Google search terms
“Survival” + “conference”. I think I see a good match.
Flag: Preppercon
Sign me up!
What email is associated with the device?
ALEAPP > Gmail > roccotsachs@gmail.com
Flag: roccotsachs@gmail.com
Not so popular
How many messages were sent from Rocco in Twitter Direct Messages?
Checked ALEAPP > FCM_Twitter_DM for info. That returns “0”. That’s not right, is it?
Hopping back to AXIOM > Social Networking > Twitter Direct Messages >
We find evidence that shows Rocco sent a message and has Recipient ID of 1719897971716685824
Sort by sender id and count with my fingers to find 16 messages.
Flag: 16
You can never be too ready
How many additional survival tips were provided in the $9 book Rocco was looking into?
AXIOM > Web Related > Chrome Web Visits
Scroll through the list and visit interesting sites. Found this:
(Later I saw that image in a cache somewhere.)
Flag: 72
Tag you’re it!
What city was the user in when they identified an AirTag on them?
While browsing around earlier in ALEAPP, I noticed “AirTag” while scrolling. Let’s go see what info we can get from there.
ALEAPP > Airtag Detection > Android Airtag Scans > coordinates to maps
Flag: Windsor
R-E-J-E-C-T-E-D Rejected
When was the last shutdown that was initiated by Rocco? (YYYY-MM-DD HH:MM:SS) UTC 24 hour time.
ALEAPP > Power Events > Shutdown Checkpoints
Flag: 2023-12-28 23:47:29
No two cents about them
According to exCHANGEs in discord with Chad, what did Chad want back from Rocco?
ALEAPP > Discord Chats > Discord Chats
Flag: Money
Out of Stock
What is the most recent score in Subway Surfer
Axiom > Entered “subwaysurf” as a search item > Application usage > Application Activity – Android > com.kiloo.subwaysurf
Found this image in the evidence preview pane
Flag: 1899
So Salty!
What is the handle of the person who is talking about how upset they are with Rocco?
AXIOM > Entered search term “salty” > Twitter search
AuthorID is 1739363969809227776
But what do I do with that? Didn’t see anything jumping out in AXIOM.
Found a couple of sites that claim to convert IDs to usernames. They didn’t.
In the end, I searched Twitter for the tweet itself
Flag: larissajenna9
DFIR101 
1 Comment