Scan of the Month |
|
Forensic Analysis of A Recovered Diskette File Offsets |
|
|
The diagram on this page is a mapping of the floppy disk using file header, footer and file size information. It depicts where on the floppy I found each piece of information. The numbers on the left are starting sector numbers and the numbers on the right are the hexadecimal offsets into the disk image where the files begin and end. The calculations are included in the diagram. The JPEG map showing the probable meeting place for Jimmy Jungle and John Smith begins at offset 0x4200 and ends at offset 0xC159. The BMP map showing Jungle's probable hideout begins at 0xC200 and ends at 0x11CB26. BMP header file size information was used to calculate this offset. At offset 0x12BB50 I found what looks like a password for a password protected file. John Smith's address begins at Ox156760. Short pieces of text are included in the diagram; however, only with thier start sector and offsets. In the detailed discussion following the disk map the start and stop possitions of those elements are included. They were too small to diagram.
|
![]() |
Mapping offsets into the image for all findings helped me to determine if
there were other places to search for data on the disk. I made a few
informed assumptions about where data may be located beyond sector 33. My
initial concern was that if much fragmentation existed data recovery might
be very difficult, since Jungle formatted the disk. Therefore I assumed
that for such a small disk with so limited purpose most of the data,
would exist in contiguous sectors. The disk uses only one sector
per cluster making things much easier. I have included here some
useful data from the boot sector used in the analysis:Bytes per sector = 512 Sectors per cluster = 1Assuming many findings are in contiguous locations I began mapping the diskette to identify unresolved areas for further analysis. A discussion of this mapping process is below. I established the location of the JPEG file with its header and footer codes using a hex search feature of WinHex. The diagram includes the hex codes searched for and what they mean. I established the location of beginning of the BMP file with its BM header code. Calculations based on file size information in the BMP header puts the end of the file at 0x11CB26. The calculations and other information are included in the diagram. Between offset 0xC159 at the end of the JPEG marker and at the beginning of the BMP header offset 0xC200 are the hex values 00 00 00 for all bytes in between, observed one byte at a time. Therefore, there is no additional information hidden there.
Next scanning sectors between 2375 and 2739 I explored the one region where it was not clear if any additional data might be found. For the most part I only found repeating bytes of FF FF or FF FE or mostly F6 F6 until I reached sector 2397 at offset 0x12BB50. From that offset and ending at offset 0x12BB56, I found text not previously discovered by the other text gathering or searching techniques mentioned earlier in the "Forensic Process" section. The text is as follows: pw=help Following the password are repeating F6 F6 F6 values until the John Smith address between offsets 0x156760 and 0x156796 in sector 2739. Following offset 0x156796, the end of John's address again are repeating F6 F6 F6 values until 0x167FFF in Sector 2879 at the end of floppy. The "pw=help" suggests a password protected file exists with the password, help. The floppy has been mapped and all areas have been accounted for. Since encrypted files appear as garbage text when decoded, containing many symbols along with meaningless text characters, I examined text decoding for all the sectors following the JPEG file and found no random garbage text. By far the largest file is the BMP file. It follows the JPEG file. It is possible that the file size information in the BMP header was altered so that another file was included, but no random garbage text displayed while scanning those sectors and the 3 byte RGB values found in the file made scense for the colors chosen for the map and the map displayed clearly and well. When viewed in paint's print preview the image is split between two pages perhaps accounting for some of its large size. The JPEG file is only 32,601 bytes long and the image clear when displayed, so it is unlikely that Jungle moved the JPEG footer codes to include another file.
|