Honeynet Project
Scan of the Month 24
2002

OFFICAL RESULTS PAGES

Question/Answer 5, Continued

Question:
What processes did you (the investigator) use to successfully examine the entire contents of each file?

Answer:
Cover page.jpg - misrepresented/Restored

File extension "jpg" was changed to "jpgc"
-Changed file extension from "jpgc" to "jpg"

Starting cluster was changed from "42" to "420"
-Performed "jpg" signature search and found one located on cluster "42". As a result, starting cluster "420" (listed in the root directory) was then changed to starting cluster "42"

Password "goodtimes" found in slack space of data.
-Documented password for later use