Ghost_in_the_Journal
Forensics
200 pts
standard
Challenge Description
A senior employee at a technology firm abruptly resigned last week. Shortly before leaving, he was suspected of leaking confidential internal project information to an external contact.
The employee claims that all conversations were deleted and that no sensitive data was ever shared.
You have been provided with a full filesystem extraction of the employee’s Android device recovered during an internal investigation.
Your task is to determine what actually happened.
Digital evidence never truly disappears — sometimes it just hides in the right places.
Submit Flag
Login to submit a flag.