Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to a thumbdrive. The only thing visible was a text file, which contained a password.

I knew there had to be more, so I used an undelete utility and found 2 deleted files. First there was another text file with a password - easy. The other was a .pst file which I mounted into Outlook. There were some emails with passwords, as well as an email with an image. Another email has a link to a steganography site.

Obviously, there was a file hidden in the image, so I went to the website and downloaded the steganographic decoder.I had to try some of the passwords I had found to get the file to decrypt, and sure enough, there was another text file with a password. I called it a day at that point.

Did I miss any other methods?

share|improve this question
    
What else was on the disk? Was it an installed OS? –  Polynomial Aug 28 '12 at 9:42
    
No, just a 2mb FAT file system –  Keltari Aug 28 '12 at 9:46
1  
You probably got them all, then. Unless there's a deleted partition or something. –  Polynomial Aug 28 '12 at 9:48
    
I didnt think of that. However, the image was clearly taken from a floppy, as the file is 1.44 MB. –  Keltari Aug 28 '12 at 9:57
1  
Deleting an email in outlook might have leave some remaining data. So perhaps you missed a password in a deleted email. –  CodesInChaos Aug 28 '12 at 17:57
show 1 more comment

migrated from superuser.com Aug 28 '12 at 9:39

This question came from our site for computer enthusiasts and power users.

2 Answers

Forensics is a very interesting field to get into because it really all comes down to detective work. First finding the breadcrumbs, then following them to their conclusion. You're definitely off to a good start. As was mentioned by a commenter, the program strings is very handy. It processes a binary file looking for sequences of printable ASCII characters. Using it you can often find text segments of databases or executables and sometimes very handy data.

I would also try taking the next step and move on to trying out an actual forensics examination tool. The Linux tool Sleuthkit, and the web interface Autopsy, are fantastic free tools for doing this kind of work. You'll also want to look more in-depth at the technique called File Carving, with some of the available tools listed on this wiki page. Since good file carving doesn't always depend on certain file system data structures being intact, you will be able to find a lot more files than a simple undelete will.

Since most of the good free tools are Linux based, you'll need to have an acceptable working environment. If you don't, then try your hand at using the BackTrack LiveCD. It is a Linux distro specially designed for use by penetration testers, and to a less extent forensics examiners. It ships with both Sleuthkit and Autopsy, as well as a large number of file carving and other forensics utilities.

share|improve this answer
    
Members have edited my original question to the point where it has lost the purpose of why I did the "challenge." Doesnt matter. It was interesting and fun to do something I dont normally do. –  Keltari Aug 28 '12 at 18:22
add comment

One likely possibility is directly writing to sectors on the disk. The fact that it was distributed as an image makes this seem like a decent possibility. In High school a friend of mine and I designed our own login system that relied on a key stored to a normally unaddressable location on the disk outside of the partition. A low level review of the binary contents of the disk image would have been a good last step to look for anything not 0 initialized.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.