Scan of the Month Report

October 25, 2002
by Barbara J. Pease




Answers to questions 1 - 5:

1. Jimmy Jungle, 626 Jungle Ave Apt 2, Jungle, NY 11111.

2. Jimmy Jungle is featured in "POT SMOKERS MONTHLY" as this month's pot grower, smoker
   and  seller. This corroborates Joe's statement he made to the undercover officer just before
   his arrest and is important to the police because Joe Jacobs refused to validate that
   statement. It identifies Jimmy Jungle as the Joe's supplier/producer further corroborating
   Joe's Statements in his letter to Jimmy. It helps to build a case against Jimmy Jungle. The
   police are also interested in Jimmy Jungle.

3. Besides Smith Hill High School Joe Jacobs frequents: Key High School, Leetch High School,
   Birard High School Richter High School, and Hull High School.

4. Looks like Joe used the password, goodtimes, to protect his schedule. He deleted his
   letter to Jimmy Jungle. Although the file, cover page.jpc, shows up in a directory
   listing, the file or file system is corrupted in some way to prevent it from being opened.
   It is not clear if this was deliberate. The extension was renamed to jpgc possibly to
   obscure the file type.

5. Processes I used in the investigation

   I downloaded image.zip and write protected it. I Compared the md5 hash of the downloaded
   image.zip and the original file to make sure they were identical. I then unbundled archive
   with gunzip on Solaris System and write protected that.

   I ran the Unix utility, strings, against the image file to gather any text strings and saved
   the output in strings_image.out.  The HTML version is strings_image.out.html.  The file,
   strings_image.out contains the letter to Jimmy Jungle.  Strings_image.out also contains
   a password, goodtimes, that appears to be associated with an MS Excel spread sheet,
   Scheduled Visits.xls:
              pw=goodtimes
              Scheduled Visits.xls

   Strings_image.out shows that a JFIF file type more than likely follows represented by
   garbage characters typical when viewing binaries as text.  I used this information to
   recover the image file, cover page.jpgc.

   On the Solaris system I restored the image to a floppy with dd and synced the file system
   info to the diskette.  I then write protected the diskette.

   I have PC emulation software with Windows 98 SE running on my PowerBook (G3) system
   under MacOS 9.1. Just opening drive A in Windows 98 I could see only two files listed. One
   appeared to be an oddly named JPEG file and the other a self extracting archive,
   SCHEDU~1.EXE. The Jimmy Jungle letter was not there indicating Joe probably deleted it.

   Using WinHex to open the physical drive A to read in my image, I recovered by file type
   (JPG/JFIF) as a fixed sized file of 500k to get file0000.jpg, the cover page.jpgc file. I
   also recovered a DOC/XLS file with the letter to Jimmy Jungle, Jimmy Jungle.doc using the
   same technique. The file, Jimmy Jungle.html, is the same letter saved as text.

   I opened SCHEDU~1.EXE in Internet Explorer from another write enabled diskette in
   drive A: and it opened like a download giving me a choice to execute the self extracting
   archive. I selected to execute it and I typed the password, goodtimes, at a password
   prompt and extracted it. That worked.  I was able to open Scheduled Visits.xls in MS Excel
   and print out the schools and schedules. Unfortunately, I did not save the file and I was
   not able to repeat this sequence again from within IE. It is not clear why it worked
   initially and not in subsequent attempts.

   All other attempts to execute the self extracting archive failed: execution in WinZip,
   WinHex, at DOS prompt or in Windows98.  At the DOS prompt it failed trying to execute
   an illegal instruction.  In a window it invoked an error message claiming it is not a Win32
   application.  WinHex just claimed it failed and WinZip couldn't extract it.  I ran
   SCHEDU~1.EXE in DOS mode and it hung. I tried several methods to get it to work as
   recommended by the DOS program trouble shooting guide.  Nothing worked, so I
   did not find a reliable method to extract Joe's schedule again.  Dumb luck and an
   anomalous execution path got me the information on my first try.

   Other files included with this submission to the contest represent raw data and
   may not be well formatted. Text material representing raw data was simply saved
   to disk in MS Word as an HTML file.  I fixed the HTML coding in SimpleText to make
   the raw data appear in a slightly better format than what MS Word had produced.