The Google Takeout Data comes in a Zip file. Honestly, even though there was a warning of malware, I doubt the malware would come from the Takeout data. To stay on the safe side, I still went through all files in a Remnux/Sift Virtual Machine.
Information
If you followed my setup for the VM, I created a working directory “Magnet” where I downloaded and unzipped the (small) images.
My Recommendations
Verify the hash with md5sum:
md5sum takeout-20210318T175439Z-001.zip
unzip takeout-20210318T175439Z-001.zipWalkthrough
1. You got mail (5)
How many emails were received from notification@service.tiktok.com?
It makes sense that the emails would be stored in the .mbox file ‘All mail including Spam and Trash.mbox’.
grep -r "notification@service.tiktok.com" Takeout/Mail/*
To filter for emails received from Tiktok, you can adjust the grep command like so:
grep -r 'From: "TikTok"' Takeout/Mail/*
Answer: 6
2. Hungry for directions (10)
Where did the user request directions to on Mar 4, 2021 at 4:15:18 AM EDT?
The Maps Folder contains relatively no information valuable to this case. The only other source is My Activity/Maps/My Activity.html. I tell grep to print the line above and after my string, as I’m not sure of the format of this file and where the directions requested may be.
html2text Takeout/My\ Activity/Maps/MyActivity.html | grep 'Mar 4, 2021' -B 1 -A 1
Answer: Chick-fil-A
3. I got three subscribers and counting (10)
How many YouTube channels is the user subscribed to?
First, let’s find out if there’s anything relevant in the YouTube and YouTube Music directory.
ls -la Takeout/YouTube\ and\ YouTube\ Music/
As we can see there is a subscriptions directory, which we can further examine:
ls -la Takeout/YouTube\ and\ YouTube\ Music/ subscriptions/
The Subscription information for YouTube must be in subscriptions.json. To see what files are in there:
cat Takeout/YouTube\ and\ YouTube\ Music/subscriptions/subscriptions.json
[] means the entry is empty, so Eli Flatt is not subscribed to any channel!
Answer: 0
4. Time flies when you’re watching YT (10)
What date was the first YouTube video the user watched uploaded? (Format: month day, year) (Example: Feb 3 2020)
There is a folder ‘History’ in the YouTube directory.
ls -la Takeout/YouTube\ and\ YouTube\ Music/history
As we can see there is a subscriptions directory, which we can further examine:
Given the question, watch-history.html is the file we are after.
html2text Takeout/YouTube\ and\ YouTube\ Music/history/watch-history.html
A quick google search of “The Best Clips of 2020 | Lacross Highlights ECD Lacrosse” and we get the upload date.
Answer: Jan 27, 2021
5. Who defines essential? (10)
What was searched on Mar 4, 2021 at 4:09:35 AM EDT?
In my activity there is a folder called “Search”, which contains the file MyActivity.html. From the previous questions, we can see that the datetime formatting is “Month day, year , h:mm:ss AM/PM TZ”, so we need to adjust grep for that:
html2text Takeout/YouTube\ and\ YouTube\ Music/history/watch-history.html
A quick google search of “The Best Clips of 2020 | Lacross Highlights ECD Lacrosse” and we get the upload date.
Answer: is travelling to get chicken essential travel
6. How much? (50)
What is the price of the belt ?
Grepping for”belt” in the entire directory gives no promising result. If we dig a little bit, there is a “To-Purchase.xlsx” file in his drive, where he listed a bunch of things he wants to buy.
xlsx2csv Takeout/Drive/To-Purchase.xlsx
The first item on the list is a “Pebbled Leather Belt” priced at 98.5 USD.
Answer: 98.5
