Honeynet Project
Scan of the Month 24
2002

OFFICAL RESULTS PAGES

Questions/Answer 4, Continued

Question:
For each file, what processes were taken by the suspect to mask them from others?

Answer:
Cover page.jpg - misrepresented

File extension "jpg" was changed to "jpgc".

Starting cluster was changed from "42" to "420". No data found at cluster 420.

Password "goodtimes" found in slack space of data.