Submission by Dophine V. Britanico  < Philippines

   E-mail: lando_lando@eudoramail.com

Analyze the modified floppy recovered from Jimmy Jungle residence given and image by  Police Officers from previous sweep on his supposed hideout, and obtain as much incriminating information  Document the process and techniques used to alter and mislead the digital forensic analyst to recover crucial data on the floppy disk.

In my first submission on Honeynet Scan24 ( Downloaded: Oct 21/02/12:36 AM
Finish:Oct 21/02/4:08 AM Previous Submission ) which is hopefully did not make it on the top 20's submissions due maybe to poor write-up on my part (Yeah, my apologies for I'm no good English writer) and the first thing I thought on Scan24 is that its a child play because on the nature in which I fairly and easily obtained all the information on the challenge. That gives me  enough ego boost when again I happened to obtain a copy of Honeynet Scan26, swearing this time  that this challenge is another child play, then It came to me in suprise that I was wrong and did I was. For the almost five (5) hours in Scan24 including the fast write-up, Scan26 this time took me four (4)  hours on the first day including download just looking for one info on question  ''What kind of car is Jimmy Jungle driving?" (Feb 14)  the next day (Feb 15) wasted me another seven (7) hours, excluding this HTML write-up. That's when I finally decided I'll stop and write what I found out so far..

First I downloaded the ImageFile and guessing that this is like Scan24 I never dd the image nor perfomed md5sum since I quite trusted my download from Honeynet, next I fired up Ultra edit directly hex editing the unzipped image file (that saves me precious 3-4 minutes, instead of manually zipping the image file from linux console). At first glance, I already sense something was wrong with the File Allocation Table (FAT) at beginning offset (203h) upto offset (4200h) exactly above the 512 bytes Boot Sector Code (unbootable) which missed some of the proper identifying marks of a unique File systems stamps on the FAT. This was mark with hex (0x00) technically in D.O.S and other File System means unused bytes. Given this data scrolling down further the image file I found out exactly a trivial find, the telltale sign of a graphical file those continous streams of  identical hexadecimal streams common to RLE encoded pixels, uncommon to executable files and that took me less than 5 minutes. To prove that my assessment are correct I started searching for unique header information:  A quick reference for common header signature common on windows boxen for aspiring digital forensic analyst:

Next I search the whole image file for any occurrence of those common header signature. Luckily my assessment is correct, found a JPEG file signature (figure 1), and Windows Bitmap (figure 2). Search for other signature related to a file executable or something proves to be negative. My next move extracting the data from the image, gave me the following options. Write a program in C++, or Ansi C  in windows and or Linux, or Extract it directly using cut and paste. The first options  seems a better approach and seems to be elitist, so to speak in let say presenting here technically but will take me another 30 minutes if I do it so. Finally I took the simple, fast and effective method cut and paste the data from the image file and rename the filename to its appropriate file extension  (Turing Equivalence : -)) that took me another 5 minutes. And bingo! here's what I've got.  (figure 1.a) from the JPEG file and (figure 2.a) from the BITMAP file (I converted it to JPEG for faster upload).

So far so good, I've got the answer to questions 1 to 3 in the challenge, that leaves me questions 4 and 5 un-answered.  My next challenge were I'm stuck is looking for the kind of car Jimmy Jungle Driving, my theories probably encoded in one of those hidden picture file (steganography)  just like what I have found out in figure 2.a  John Smith's Address in Windows BMP image a clever approach ( lossless) and pw=help, most likely the JPEG image file XOR with the password ''help''.  To further analyzed the image file I decided to write it on disk and see for myself how it look like and  I maybe  missing something.

Drive to write to <A or B>:A

Next I reboot the system and make the floppy disk drive as the default boot drive to see what happen. And Hopefully our first assessment was indeed correct, the diskette is unbootable and contain to visible file entries. Next I perfomed a disk check to see if  I missed something e.g Bad Sectors, or Cross Linked files or directories that might harbor our elusive number 4 & 5 question. (Common Techniques by VX writers).

So far the disk is clean, next  I tried to find a hidden files and even looking for old hacker style alt-255 [dec] file hiding technique, finding nothing I reboot the system and continue hex editing he image file for another 3 hours, slowly taking note of any pattern I can used but still no answers for exact question for number 4 & 5. Next I decided to use linux this time to find anything that might be useful in our tinkering adventure. ''Spock aren't you dead? I rebooted...''.

I've got identical results with what I have found so far on my windows boxen compared to what I have found here in linux, but no answer for 4 & 5 :- ( that's leave me one option to code the XORing algorithm if it works.