Chromebook

Promise Me (5): How many promises does Wickr make?

# https://wickr.com/security/
9

RoadTrip (5): What city was Eli’s destination in?

Plattsburgh

Smile for the camera (5): What is the MD5 hash of the user’s profile photo?

$ md5sum decrypted/mount/user/Accounts/Avatar\ Images/[e-mail] 
5ddd4fe0041839deb0a4b0252002127b

The folder to store all your data in (5): How many files are in Eli’s downloads directory?

$ ls decrypted/mount/user/Downloads/
 network_diagnostics_2021-03-08.19-04-05.txt
'Screenshot 2021-03-04 at 3.16.31 AM.png'
'Screenshot 2021-03-04 at 3.17.06 AM.png'
 third_party_1613945285717.jpg
 tux.png
 Wickr-Customer-Security-Promises-November-2020.pdf

Autofills, roll out (10): Which word was Autofilled the most?

$ file decrypted/mount/user/Web\ Data
decrypted/mount/user/Web Data: SQLite 3.x database, last written using SQLite version 3028000
$ sqlitebrowser decrypted/mount/user/Web\ Data

email

Dress for success (10): In bytes, what is the logical size of this bird’s image?

$ ls -al decrypted/mount/user/Downloads
total 3372
drwx--x---  2 hnl hnl    4096 Apr  5 14:18  .
drwx--x--- 41 hnl hnl    4096 Apr  5 14:18  ..
-rw-r--r--  1 hnl hnl     301 Apr  5 14:18  network_diagnostics_2021-03-08.19-04-05.txt
-rw-r--r--  1 hnl hnl  320989 Apr  5 14:18 'Screenshot 2021-03-04 at 3.16.31 AM.png'
-rw-r--r--  1 hnl hnl  646347 Apr  5 14:18 'Screenshot 2021-03-04 at 3.17.06 AM.png'
-rw-r--r--  1 hnl hnl  632283 Apr  5 14:18  third_party_1613945285717.jpg
-rw-r--r--  1 hnl hnl   46791 Apr  5 14:18  tux.png
-rw-r--r--  1 hnl hnl 1782658 Apr  5 14:18  Wickr-Customer-Security-Promises-November-2020.pdf

46791

Key-ty Cat (10): What are the last five characters of the key for the Tabby Cat extension?

# find tabby cat extension at chrome store
# you will see ext id mefhakmgclhhfbdadeojlkbllmecialg
$ cat /decrypted/mount/user/Extensions/mefhakmgclhhfbdadeojlkbllmecialg/2.0.0_0/manifest.json
{
   "author": "Leslie Zacharkow",
   "chrome_url_overrides": {
      "newtab": "public/index.html"
   },
   "description": "A new friend in every tab.",
   "icons": {
      "128": "icon128.png"
   },
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjA9ElNuqHGIuDyrztUxn0nV1CLRgjSHEKw1zfhzE/6OdWd3teRV9wq4EukIX8UKf96fhS2WsLVnTuRmF7mQuqeAIxOkSvFm4Set3YRQ5994NA8Y9un1ZGhPtjFnpoLo1pEA5PPly5/BX2y3Ci2Rb0C3wp8NdeXud4r6BKEzhPdWmkwIS+YbTWhOBR1IbP/sF6+l8EdG/Ks881p8LO0J3qepmhNDA/LjVWzJq5ARmIYeT3TnvR/qRGTY9UXfUvg3gcUWV2LBBpeil8t6Np0PVYvG44zOBhKUnYSVE6gAcXENLTJJABgRgKT1K1kDYl1N8LJZf/S/9Ix1P+wItoEinTwIDAQAB",
   "manifest_version": 2,
   "name": "Tabby Cat",
   "offline_enabled": true,
   "permissions": [ "storage" ],
   "update_url": "https://clients2.google.com/service/update2/crx",
   "version": "2.0.0"
}

DAQAB

Time to jam out (10): How many songs does Eli have downloaded?

$ ll decrypted/mount/user/MyFiles/Music/
total 8644
drwx--x--x 2 hnl hnl    4096 Apr  5 14:19  ./
drwx--x--- 4 hnl hnl    4096 Apr  5 14:19  ../
-rw-r--r-- 1 hnl hnl 3632202 Apr  5 14:19 'alt-J (∆) Breezeblocks.mp3'
-rw-r--r-- 1 hnl hnl 5206236 Apr  5 14:19 'Leave - Post Malone.mp3'

2

It’s about the journey not the destination (25): How many miles would the trip have been if Eli took the long way? Answer to the single decimal digit (ex. 9.1).

$ eog 'Screenshot 2021-03-04 at 3.17.06 AM.png'
81.2

Repeat customer (25): What was Eli’s top visited site? (Domain Name)

# I think it first
$ sqlitebrowser /decrypted/mount/user/History
https://docs.google.com/spreadsheets/d/1uAv_iMnp0xt8Cn_NJqbk8zA1SPFjL3ddWWhRy8K0Gsc/edit#gid=0

# I choose it second
$ sqlitebrowser /decrypted/mount/user/Top\ Sites
https://protonmail.com/

Vroom Vroom (50): What is the name of the car related theme?

$ grep -R 'theme' */*/manifest.json
dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json:   "theme": {
dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json:         "theme_frame": "images/theme_frame.png",
dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json:         "theme_ntp_background": "images/theme_ntp_background.png",
dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json:         "theme_tab_background": "images/theme_tab_background.png",
dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json:         "theme_toolbar": "images/theme_toolbar.png"
dmghijelimhndkbmpgbldicpogfkceaj/0.4.1_0/manifest.json:   "description": "A global dark theme for the web",
eimadpbcbfnmbkopoojfekhnkhdbieeh/4.9.29_0/manifest.json:         "description": "__MSG_theme_generation_mode__"

$ cat dkkklbgbfaeockpgbkleblklmcjdbnbj/1_0/manifest.json
{
   "description": "Lambroghini Cherry",
   "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCkqKU3UqdDvEEbE02cxMeXkdPqTU3FaA48eDRGht3vrH2gI2XoDaFYKgEfBIMlvJkWfCZwMigyg1mmPg6Tkx9G4R0abm4HBd9FxOsfB6dYI4yEQYWLQIqvxLifK9Pb7zyQpghp4ovjuPQzKai8tljnKBUyqE2MSNGem4ldf3CbUwIDAQAB",
   "manifest_version": 2,
   "name": "Lamborghini Cherry ",
   "theme": {
      "colors": {

Lamborghini Cherry