Hello Reader,
Thank you for all of you who attempted our first full forensic image challenge. We are going to be alternating between images and scenarios for Sunday Fundays and I'll continue trying to to tweak the format and deadlines so all of you can have a chance! Today let's give you the answer key to this Sunday Funday and then we'll go into depth on how to recover this data.
Thank you for all of you who attempted our first full forensic image challenge. We are going to be alternating between images and scenarios for Sunday Fundays and I'll continue trying to to tweak the format and deadlines so all of you can have a chance! Today let's give you the answer key to this Sunday Funday and then we'll go into depth on how to recover this data.
Total of 13 files with bonus (10 for challenge, 3 for bonus), one file “HowToCatchARoadrunner.bmp” failed to send (though an attempt was made), so it may show as a false positive, but maybe someone catches that. Acme.zip contains two files. The original files were placed in the Recycle Bin, so the copies only made it out with the zip file. Words in blue are the files for the case.
FTP – Filezilla
Contacts folder contents
-Company A.contact,
-Company B.contact,
-Company C.contact
-Suspect.contact
Webmail - Gmail
-Birdseed Facts.rtf
-How to spear Bird.rtf
-HowToCatchARoadrunner.bmp (this one failed to send)
USB Devices
Microcenter 32 GB USB 3.0
"Unknown Device" 12FE:5200
VendorID 13FE - ProductID 5200
Revision:0110 SN:0707335DB6A54359
Verbatim Store 'n' Go - 512MB (Data copied to this device)
VendorID: 08EC - ProductID 0008
Revision: 0100
Serial No. 0AC1F7605250196A
Clicked Start, then "Documents" Selected "Acme 2013 Budget","Acme Employee Bonuses", and "Passwords"
-copied the selections to the thumbdrive (drive E:)
-opened the "Acme 2013 Budget.rtf” document
-Closed windows
-removed device at 2:49 pm
Netbook Essentials - Flash Media Solutions - Thumb Drive 2GB
-Shows as USB Disk 2.0
-VendorID: 13FE - ProductID 3200
-Revision: 0110
-Serial No. 079805001BB401AC
Netbook Essentials - Flash Media Solutions - Thumb Drive 2GB (with red markings on it)
-Shows as USB Disk 2.0
-VendorID: 13FE - ProductID: 3200
-Revision: 0110
-Serial No. 0798050023450032
Patriot Memory USB - 64 GB
-VendorID: 13FE - ProductID: 5200
-Revision: 0110
-Serial No. 0701342394A3C4813
CD Burning (bonus)
Acme.zip
-Burned from Desktop, using Windows default burning utility.
-There are two files inside the zip file.
-Information for Patent.rtf
-Prototype.bmp
This week we will go through these sections with a focus on the ones that people had the most problems with. I hope you keep up and if you didn't try and want some practice, download the image and see if you can find everything we left behind!
This week we will go through these sections with a focus on the ones that people had the most problems with. I hope you keep up and if you didn't try and want some practice, download the image and see if you can find everything we left behind!
