Trace Labs CTF — Approach and Tips

SAV OSINT
3 min readNov 29, 2020

It is good to start with a basic search engine search using the information that is provided in the Missing Person (“MP”) file. This gives more of a background on the case via media publications, which often references important details such as family members. The media articles don’t go towards flag submissions, but definitely help with information gathering further down the line, so I like to make a note of any key information I find here.

From my experience, the majority of flags in the first 30 minutes are usually gained from social media. It is important to make your searches subject relevant, although you want to identify all accounts, depending on your subject age and location, you can focus on the accounts most likely to be used by the MP. For example, Snapchat’s biggest demographic is 13–17 year olds. One of the MPs was under 16 and I noticed that their images used Snapchat filters, so I targeted my social media searches to identifying a Snapchat account.

There are many OSINT tools, but the most important aspect to these events is attention to detail. In two MP cases, it was attention to detail that allowed me to submit key flags that scored up to 500 points for the team. After identifying a newly created Instagram page for one of the MPs, I analysed the images closely, one of which featured a picture of food. Behind the food I could make out the name of the restaurant. I was then able to search the name, and luckily the restaurant only had one location. This allowed me to be area specific in my searches and also scored a last seen flag, as the photo was posted under a week ago. Unfortunately, this finding was towards the end of the event, but I would have pivoted and used this finding to identify the current location for the MP using other images, one of which featured residential buildings, likely to have been the MPs current home.

In another MP case, the information gathering from search engine searches identified CCTV footage that was released in the media, which provided many search leads. In one instance, I was able to submit a flag which pointed to where the subject might have visited before their disappearance. In the footage the MP was carrying a distinctive pink shopping back, which I was able to locate back to a specific retailer. I explained this in my submission, providing a URL to an image of the bag, as well as the location of the nearest shop in the area, and detailed that this could be a further line of inquiry for law enforcement and potentially provide additional CCTV footage to work with. It is important to explain the relevance of each flag submission, or it may not be accepted. My preference is quality over quantity, and you should dig deeper and think outside the box beyond with each piece of information you identify.

If you have run dry on flags, it is best to switch to another MP, or see if you can swap with someone else from your team to have a fresh pair of eyes. Six hours seems like a long time, but it is important not to waste it as it goes fast, so if you get stuck, move on.

Valeryia D.

--

--

SAV OSINT

OSINT team 🕵️‍♂️ Focusing on @TraceLabs missing persons capture the flag events.