Did I miss anything when checking for passwords?

Question

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to a thumbdrive. The only thing visible was a text file, which contained a password.

I knew there had to be more, so I used an undelete utility and found 2 deleted files. First there was another text file with a password - easy. The other was a .pst file which I mounted into Outlook. There were some emails with passwords, as well as an email with an image. Another email has a link to a steganography site.

Obviously, there was a file hidden in the image, so I went to the website and downloaded the steganographic decoder.I had to try some of the passwords I had found to get the file to decrypt, and sure enough, there was another text file with a password. I called it a day at that point.

Did I miss any other methods?

Answer 1

Forensics is a very interesting field to get into because it really all comes down to detective work. First finding the breadcrumbs, then following them to their conclusion. You're definitely off to a good start. As was mentioned by a commenter, the program strings is very handy. It processes a binary file looking for sequences of printable ASCII characters. Using it you can often find text segments of databases or executables and sometimes very handy data.

I would also try taking the next step and move on to trying out an actual forensics examination tool. The Linux tool Sleuthkit, and the web interface Autopsy, are fantastic free tools for doing this kind of work. You'll also want to look more in-depth at the technique called File Carving, with some of the available tools listed on this wiki page. Since good file carving doesn't always depend on certain file system data structures being intact, you will be able to find a lot more files than a simple undelete will.

Since most of the good free tools are Linux based, you'll need to have an acceptable working environment. If you don't, then try your hand at using the BackTrack LiveCD. It is a Linux distro specially designed for use by penetration testers, and to a less extent forensics examiners. It ships with both Sleuthkit and Autopsy, as well as a large number of file carving and other forensics utilities.

Answer 2

One likely possibility is directly writing to sectors on the disk. The fact that it was distributed as an image makes this seem like a decent possibility. In High school a friend of mine and I designed our own login system that relied on a key stored to a normally unaddressable location on the disk outside of the partition. A low level review of the binary contents of the disk image would have been a good last step to look for anything not 0 initialized.