1. Jimmy Jungle, 626 Jungle Ave Apt 2, Jungle, NY 11111. 2. Jimmy Jungle is featured in "POT SMOKERS MONTHLY" as this month's pot grower, smoker and seller. This corroborates Joe's statement he made to the undercover officer just before his arrest and is important to the police because Joe Jacobs refused to validate that statement. It identifies Jimmy Jungle as the Joe's supplier/producer further corroborating Joe's Statements in his letter to Jimmy. It helps to build a case against Jimmy Jungle. The police are also interested in Jimmy Jungle. 3. Besides Smith Hill High School Joe Jacobs frequents: Key High School, Leetch High School, Birard High School Richter High School, and Hull High School. 4. Looks like Joe used the password, goodtimes, to protect his schedule. He deleted his letter to Jimmy Jungle. Although the file, cover page.jpc, shows up in a directory listing, the file or file system is corrupted in some way to prevent it from being opened. It is not clear if this was deliberate. The extension was renamed to jpgc possibly to obscure the file type. 5. Processes I used in the investigation I downloaded image.zip and write protected it. I Compared the md5 hash of the downloaded image.zip and the original file to make sure they were identical. I then unbundled archive with gunzip on Solaris System and write protected that. I ran the Unix utility, strings, against the image file to gather any text strings and saved the output in strings_image.out. The HTML version is strings_image.out.html. The file, strings_image.out contains the letter to Jimmy Jungle. Strings_image.out also contains a password, goodtimes, that appears to be associated with an MS Excel spread sheet, Scheduled Visits.xls: pw=goodtimes Scheduled Visits.xls Strings_image.out shows that a JFIF file type more than likely follows represented by garbage characters typical when viewing binaries as text. I used this information to recover the image file, cover page.jpgc. On the Solaris system I restored the image to a floppy with dd and synced the file system info to the diskette. I then write protected the diskette. I have PC emulation software with Windows 98 SE running on my PowerBook (G3) system under MacOS 9.1. Just opening drive A in Windows 98 I could see only two files listed. One appeared to be an oddly named JPEG file and the other a self extracting archive, SCHEDU~1.EXE. The Jimmy Jungle letter was not there indicating Joe probably deleted it. Using WinHex to open the physical drive A to read in my image, I recovered by file type (JPG/JFIF) as a fixed sized file of 500k to get file0000.jpg, the cover page.jpgc file. I also recovered a DOC/XLS file with the letter to Jimmy Jungle, Jimmy Jungle.doc using the same technique. The file, Jimmy Jungle.html, is the same letter saved as text. I opened SCHEDU~1.EXE in Internet Explorer from another write enabled diskette in drive A: and it opened like a download giving me a choice to execute the self extracting archive. I selected to execute it and I typed the password, goodtimes, at a password prompt and extracted it. That worked. I was able to open Scheduled Visits.xls in MS Excel and print out the schools and schedules. Unfortunately, I did not save the file and I was not able to repeat this sequence again from within IE. It is not clear why it worked initially and not in subsequent attempts. All other attempts to execute the self extracting archive failed: execution in WinZip, WinHex, at DOS prompt or in Windows98. At the DOS prompt it failed trying to execute an illegal instruction. In a window it invoked an error message claiming it is not a Win32 application. WinHex just claimed it failed and WinZip couldn't extract it. I ran SCHEDU~1.EXE in DOS mode and it hung. I tried several methods to get it to work as recommended by the DOS program trouble shooting guide. Nothing worked, so I did not find a reliable method to extract Joe's schedule again. Dumb luck and an anomalous execution path got me the information on my first try. Other files included with this submission to the contest represent raw data and may not be well formatted. Text material representing raw data was simply saved to disk in MS Word as an HTML file. I fixed the HTML coding in SimpleText to make the raw data appear in a slightly better format than what MS Word had produced.