# Simson L. Garfinkel # simsong@acm.org # DFRWS 2006 Challenge Report # ################################################################ File type: JPG File size: 287186 MD5 hash: daf4205574abd6919b10ca8be92d17a3 Assigned filename: image03868.jpg Sectors: 3868-4428 Comments: Artist rendering of mars spirit and opportunity on mars =============================================== File type: JPG File size: 608703 MD5 hash: 4efc6c572683878efd8f3404ddaded7b Assigned filename: image08285.jpg Sectors: 8285-9473 Comments: Photo from AFRL/DFRWS 2004; woman with long hair and three men peer at laptop =============================================== File type: JPG File size: 7113968 MD5 hash: b070beae1606f67a342bc5f78c29c743 Assigned filename: image12222.jpg Sectors: 12222-26116 Comments: Blue photo shop image, "DFRWS 2006 Forensic Challenge" =============================================== File type: JPG File size: 189534 MD5 hash: fe7e7ac67709f2d9c2483aa98c681b99 Assigned filename: image27607.jpg Sectors: 27607-27977 Comments: Photograph, "The Porcupine," a cafe in Paris =============================================== File type: JPG File size: 178659 MD5 hash: 2fae8770cc013d22e9ea1c070f2f509b Assigned filename: image36292.jpg Sectors: 36292-36640 Comments: Radio telegraph of a distnt galaxy? Red, Orange, Yellow =============================================== File type: JPG File size: 304413 MD5 hash: c0da37b3f1a07af790e6e9171cedc4d2 Assigned filename: image43434.jpg Sectors: 43434-44028 Comments: Photograph, DFRWS, Brian C. at his laptop =============================================== File type: JPG File size: 24538540 MD5 hash: db32b271506b2f4974791957627c61cc Assigned filename: image46910.jpg Sectors: 46910-94836 Comments: Photo shop image, Orange, "DFRWS 2006 Forensic Challenge" =============================================== File type: ZIP File size: 147150 MD5 hash: ebabde39ba44d38888dd82606980498a Sectors: 28439-28726 Assigned filename: zipfile28439.zip Comments: zipfile containing copy.jpg and associate mac info Archive: found0/zipfile28439.zip 201216 bytes 5 files -rw-r--r-- 2.1 unx 63205 bX defN 17-Feb-06 00:18 4n6rodeo3-fix copy.jpg drwxrwxr-x 2.1 unx 0 bx stor 8-May-06 22:31 __MACOSX/ -rw-r--r-- 2.1 unx 82 bX defN 17-Feb-06 00:18 __MACOSX/._4n6rodeo3-fix copy.jpg -rw-r--r-- 2.1 unx 83818 bX defN 17-Feb-06 00:18 4n6rodeo4-fix copy.jpg -rw-r--r-- 2.1 unx 82 bX defN 17-Feb-06 00:18 __MACOSX/._4n6rodeo4-fix copy.jpg 5 files, 147187 bytes uncompressed, 146306 bytes compressed: 0.6% ** These are both digital photos from a DFRWS with people around a laptop with beer ================================================================ File type: DOC File size: 287232 MD5 hash: 0e52e75029e99cd2e9dcd0af271cf4a2 Sectors: 32837-33397 Assigned filename: msoffice32837.doc Comments: US TSA "Permitted and Prohibited Items," 5 pages ================================================================ File type: DOC File size: 71680 MD5 hash: 109284cc5abddc83879a29785795fd75 Sectors: 45964-46103 Assigned filename: msoffice45964.doc Comments: Farm Credit System Insurance Cop., Statement, March 31, 2006-Dec. 31 ================================================================ File type: HTML File size: 187793 MD5 hash: 158496c522d97b7389c9907cae777ac1 Sectors: 29529-29895 Assigned filename: htmlfile29529.html Comments: Full text of "The Tempest" ================================================================ File type: HTML File size: 33786 MD5 hash: 4873caaaae66f586eca303f5183798db Sectors: 4436-4501 Assigned filename: htmlfile04436.html Comments: Full text of "A STUDY IN SCARLET," Part 1, Chapter 1 ================================================================ ### ### These were manually carved ### ================================================================ filename: c-commedy.html sectors: 27496-27606 27978-28196 File type: HTML file size: 168527 MD5 hash: a80ee062aed8279304faae8f20f6d48e Comments: Full text of "A commedy of Errors" ================================================================ Assigned filename: c-alice.html File type: HTML File size: 18147 MD5 hash: eec87931b03e5a4a4ef8fd51109a1227 Sectors: 9-44 Comments: Web page with part of "Alice in Wonderland" and an Amazon advertisement ================ Assigned filename: c-alice-dup.html File type: HTML File size: 4096 Sectors: 0-8 Comments: Duplicate of 9 sectors from Alice. ================================================================ Assigned filename: c-moby001.txt File type: TXT File size: 12826 MD5 hash: f800a46e18fafd309825c5ee84a654a2 Sectors: 11823-11848 Comments: Appears to be from http://www.princeton.edu/~batke/moby/moby_001.html, but is missing first 159 bytes and some HTML is stripped. Nevertheless, line breaks and markup is identical. My guess is that this was viewed in a web browser and then saved to disk as text. =============================================== Assigned filename: moby-ch84.txt File type: TXT File size: 20019 MD5 hash: 045798407b927321326a547704e67831 Sectors: 28244-28245 28307-28344 Comments: Appears to be chapter 84 of Moby Dick, from http://www.princeton.edu/~batke/moby/moby_134.html. ================================================================ Assigned filename: c-holmes.txt File type: TXT File size: 53871 MD5 hash: 81a394a3b8d3cd03a4f2069d5084866c Sectors: 34307-34412 ================================================================ Assigned filename: c-dickens.txt File type: TXT File size: 27876 MD5 hash: 13a992c26ad8d353520795f95824f005 Sectors: 4502-4556 Comments: From A Christmas Carrol =============================================== Assigned Filename: c-french.txt File type: TXT sectors: 28246-28306 File size: 30816 MD5 hash: 616a6bbe915c3dbf51014fd76f55b0e3 Comments: De la division du travail social / Imile Durkheim http://socserv2.socsci.mcmaster.ca/~econ/ugcm/3ll3/durkheim/divtrav.html (French philosophy from the 19th century.) ================================================================ ################################################################ ### These were carved by assembling two fragments ################################################################ =============================================== Assigned filename: image11619.jpg File type: JPG File size: 190720 Sectors: 11619-11822 11849-12017 Comments: Green bacteria MD5 hash: 7b07320709e0caa947663f5df3a0a390 =============================================== Assigned filename: image94846.jpg File type: JPG File size: 924877 Sectors: 94846-95628 95630-96653 MD5 hash: 1a5a843000ef617af93a9cad645e3cdf Comments: Saturn "Hubble Heritage" photo =============================================== Assigned filename: image41611.jpg File type: JPG File size: 1021085 Sectors: 41611-43433 44029-44200 MD5 hash: 7cce072e518fd72484c97adb1b4be08e Comments: Spiral Galaxy M101 - Hubblesite.org =============================================== Assigned filename: image45566.jpg File type: JPG File size: 573499 Sectors: 45566-45963 46104-46826 MD5 hash: 2320fe9c41eaddb864a56c2ddc4dd186 Comments: "1565 80m coarse calc. sand" Apparently downloaded from http://pubs.usgs.gov/of/2001/of01-154/data/bphotos/browse/1565.jpg =============================================== ### ### This one was found with an overnight job running ### the split carver with an offset of -1, then -2, then -3, ### which kept shrinking the first half. =============================================== Assigned filename: image40638.jpg File type: JPG File size: 487473 MD5 hash: f8c51e0688796b5d616f0e5d4a94d104 Sectors: 40638-41219 41239-41609 Comments: Photograph from DFRWS 2004 of several atendees Found by removing 5 sectors from the "complete" run at 40638 =============================================== ### ### These two were carved with the improved information that came from ### decoding the zip files to determine their actual length, which told ### me how many sectors had been added. I then used split_carve_hole ### with the start and end and the supplied hole ================================================================ # carver c(im,zip_ccb); # c.split_carve_hole(45015,45545,3); # Assigned filename: zipfile45015.zip File type: ZIP File size: 270336 Sectors: 45015-45386 45390-45545 MD5 hash: 68bb9dc8be238e3a7fd684fc99c92bd3 Comments: % unzip -Z zipfile45015.zip Archive: zipfile45015.zip 270336 bytes 6 files -rw-r--r-- 2.1 unx 62179 bX defN 8-May-06 22:35 1993-01-a-large_web.jpg -rw-r--r-- 2.1 unx 37157 bX defN 8-May-06 22:36 1995-45-a-large_web.jpg -rw-r--r-- 2.1 unx 44808 bX defN 8-May-06 22:34 2000-06-a-large_web.jpg -rw-r--r-- 2.1 unx 28740 bX defN 8-May-06 22:35 2000-07-a-large_web.jpg -rw-r--r-- 2.1 unx 42629 bX defN 8-May-06 22:35 2002-29-a-large_web.jpg -rw-r--r-- 2.1 unx 55610 bX defN 8-May-06 22:35 2005-02-e-large_web.jpg 6 files, 271123 bytes uncompressed, 269163 bytes compressed: 0.7% % >>> These are all space images, although I can't tell from where ================================================================ Assigned filename: zipfile28729.zip File type: ZIP File size: 1163776 Sectors: 28729-29528 29896-31368 MD5 hash: 99109ba68d174d08bc5fb3b29d7f67f3 Comments: Archive: zipfile28729.zip 1163776 bytes 2 files -rw-r--r-- 2.1 unx 513027 bX defN 8-May-06 22:34 file1.jpg (Cone Nebula) -rw-r--r-- 2.1 unx 725993 bX defN 8-May-06 22:34 file2.jpg (Pistol Star and Nebula) 2 files, 1239020 bytes uncompressed, 1163447 bytes compressed: 6.1% ================================================================ # # For these, I used split_carve_find_hole, since I didn't know how big # the hole was... =============================================== # carver c(im,jpeg_ccb); # c.split_carve_find_hole(31533,32773,413); Assigned filename: image31533.jpg File type: JPG File size: 566012 Sectors: 31533-31752 31888-32773 MD5 hash: 5724f115a65c23421b8b764c3c611b2d Comments: Mars # (the top half is 219 blocks, but I didn't get a C_ERR # until block 355!) =============================================== Assigned filename: image31475.jpg File type: JPG File size: 98354 Sectors: 31475-31532 31753-31887 MD5 hash: db89684c177168036e274140ecf766a1 Comments: Porcupine =============================================== # # This was found by reconstructing a workable MSWord file that # contained the first page with the split carver and msinfo validation # function. I knew exactly how long it was. I went to the web. Found # the document. Downloaded it. It was the same size. Then I used the md5 # trick to find the blocks. Assigned filename: sp800-26.doc File type: DOC File size: 943616 Sectors: 34288-34306 34413-36236 MD5 hash: d7ff92b8cc1c89c46a78288b9c673152 Comments: NIST Publication 800-26 Security Self-Assessment Guide for Information technology systems ================ Assigned filename: preventing36998.doc File type: DOC Sectors: 36998-37649 37727-39427 39477-40380 File size: 1667584 MD5 hash: 4a22f04b097920d11fff4e192e0667a4 Comments: Preventing crime (Sherman et al) WHAT WORKS, WHAT DOESN'T, WHAT'S PROMISING downloaded from http://www.ncjrs.org/docfiles/wholedoc.doc ================ Assigned filename: 477-modified.xls File type: XLS File size: 869888 Sectors: 2051-3050 3072-3770 MD5 hash: 03d1deff4774c932358d3580a3bbae66 Comments: FCC form 477, slightly modified Downloaded from http://www.fcc.gov/Forms/Form477/477.xls, but two sectors are different. (My Excel validation program didn't work on this...) ================ Assigned filename: msoffice07964-8284_9474-11618.doc File type: DOC Sectors: 7964-8284 9474-11618 File size: 1262592 MD5 hash: d37a59cbd3e3cfcae77a22a6ca3c0bea Comments: News release from Great Sand Dunes National Park and Preserve ================ Here are the regions that are uncarved: Uncarved Regions: 45 -- 2050 (2006 sectors) 3051 -- 3071 (21 sectors) 3771 -- 3867 (97 sectors) 4429 -- 4435 (7 sectors) 4557 -- 7963 (3407 sectors) 12018 -- 12221 (204 sectors) 26117 -- 27495 (1379 sectors) 28197 -- 28243 (47 sectors) 28345 -- 28438 (94 sectors) 28727 -- 28728 (2 sectors) 31369 -- 31474 (106 sectors) 32774 -- 32836 (63 sectors) 33398 -- 34287 (890 sectors) 36237 -- 36291 (55 sectors) 36641 -- 36997 (357 sectors) 37650 -- 37726 (77 sectors) 39428 -- 39476 (49 sectors) 40381 -- 40637 (257 sectors) 41220 -- 41238 (19 sectors) 41610 -- 41610 (1 sectors) 44201 -- 45014 (814 sectors) 45387 -- 45389 (3 sectors) 45546 -- 45565 (20 sectors) 46827 -- 46909 (83 sectors) 94837 -- 94845 (9 sectors) 95629 -- 95629 (1 sectors) 96654 -- 97655 (1002 sectors) And here is a map: +--- 0 | | c-alice-dup.html | 9 sectors | Duplicate of 9 sectors from Alice. | +--- 8 +--- 9 | | c-alice.html | 36 sectors | Web page with part of "Alice in Wonderland" and an Amazon advertisement | +--- 44 [ 2006 sectors total in uncarved region ] +--- 2051 | | 477-modified.xls (part 1) | 1000 sectors | FCC form 477, slightly modified | +--- 3050 [ 21 sectors total in uncarved region ] +--- 3072 | | 477-modified.xls (part 2) | 699 sectors | FCC form 477, slightly modified | +--- 3770 [ 97 sectors total in uncarved region ] +--- 3868 | | image03868.jpg | 561 sectors | Artist rendering of mars spirit and opportunity on mars | +--- 4428 [ 7 sectors total in uncarved region ] +--- 4436 | | htmlfile04436.html | 66 sectors | Full text of "A STUDY IN SCARLET," Part 1, Chapter 1 | +--- 4501 +--- 4502 | | c-dickens.txt | 55 sectors | From A Christmas Carrol | +--- 4556 [ 3407 sectors total in uncarved region ] +--- 7964 | | msoffice07964-8284_9474-11618.doc (part 1) | 321 sectors | News release from Great Sand Dunes National Park and Preserve | +--- 8284 +--- 8285 | | image08285.jpg | 1189 sectors | Photo from AFRL/DFRWS 2004; woman with long hair and three men peer at laptop | +--- 9473 +--- 9474 | | msoffice07964-8284_9474-11618.doc (part 2) | 2145 sectors | News release from Great Sand Dunes National Park and Preserve | +--- 11618 +--- 11619 | | image11619.jpg (part 1) | 204 sectors | Green bacteria | +--- 11822 +--- 11823 | | c-moby001.txt | 26 sectors | Appears to be from http://www.princeton.edu/~batke/moby/moby_001.html, | +--- 11848 +--- 11849 | | image11619.jpg (part 2) | 169 sectors | Green bacteria | +--- 12017 [ 204 sectors total in uncarved region ] +--- 12222 | | image12222.jpg | 13895 sectors | Blue photo shop image, "DFRWS 2006 Forensic Challenge" | +--- 26116 [ 1379 sectors total in uncarved region ] +--- 27496 | | c-commedy.html (part 1) | 111 sectors | Full text of "A commedy of Errors" | +--- 27606 +--- 27607 | | image27607.jpg | 371 sectors | Photograph, "The Porcupine," a cafe in Paris | +--- 27977 +--- 27978 | | c-commedy.html (part 2) | 219 sectors | Full text of "A commedy of Errors" | +--- 28196 [ 47 sectors total in uncarved region ] +--- 28244 | | moby-ch84.txt (part 1) | 2 sectors | Appears to be chapter 84 of Moby Dick, from | +--- 28245 +--- 28246 | | c-french.txt | 61 sectors | De la division du travail social / Imile Durkheim | +--- 28306 +--- 28307 | | moby-ch84.txt (part 2) | 38 sectors | Appears to be chapter 84 of Moby Dick, from | +--- 28344 [ 94 sectors total in uncarved region ] +--- 28439 | | zipfile28439.zip | 288 sectors | zipfile containing copy.jpg and associate mac info | +--- 28726 [ 2 sectors total in uncarved region ] +--- 28729 | | zipfile28729.zip (part 1) | 800 sectors | | +--- 29528 +--- 29529 | | htmlfile29529.html | 367 sectors | Full text of "The Tempest" | +--- 29895 +--- 29896 | | zipfile28729.zip (part 2) | 1473 sectors | | +--- 31368 [ 106 sectors total in uncarved region ] +--- 31475 | | image31475.jpg (part 1) | 58 sectors | Porcupine | +--- 31532 +--- 31533 | | image31533.jpg (part 1) | 220 sectors | Mars | +--- 31752 +--- 31753 | | image31475.jpg (part 2) | 135 sectors | Porcupine | +--- 31887 +--- 31888 | | image31533.jpg (part 2) | 886 sectors | Mars | +--- 32773 [ 63 sectors total in uncarved region ] +--- 32837 | | msoffice32837.doc | 561 sectors | US TSA "Permitted and Prohibited Items," 5 pages | +--- 33397 [ 890 sectors total in uncarved region ] +--- 34288 | | sp800-26.doc (part 1) | 19 sectors | NIST Publication 800-26 | +--- 34306 +--- 34307 | | c-holmes.txt | 106 sectors | +--- 34412 +--- 34413 | | sp800-26.doc (part 2) | 1824 sectors | NIST Publication 800-26 | +--- 36236 [ 55 sectors total in uncarved region ] +--- 36292 | | image36292.jpg | 349 sectors | Radio telegraph of a distnt galaxy? Red, Orange, Yellow | +--- 36640 [ 357 sectors total in uncarved region ] +--- 36998 | | preventing36998.doc (part 1) | 652 sectors | Preventing crime (Sherman et al) | +--- 37649 [ 77 sectors total in uncarved region ] +--- 37727 | | preventing36998.doc (part 2) | 1701 sectors | Preventing crime (Sherman et al) | +--- 39427 [ 49 sectors total in uncarved region ] +--- 39477 | | preventing36998.doc (part 3) | 904 sectors | Preventing crime (Sherman et al) | +--- 40380 [ 257 sectors total in uncarved region ] +--- 40638 | | image40638.jpg (part 1) | 582 sectors | Photograph from DFRWS 2004 of several atendees | +--- 41219 [ 19 sectors total in uncarved region ] +--- 41239 | | image40638.jpg (part 2) | 371 sectors | Photograph from DFRWS 2004 of several atendees | +--- 41609 [ 1 sector total in uncarved region ] +--- 41611 | | image41611.jpg (part 1) | 1823 sectors | Spiral Galaxy M101 - Hubblesite.org | +--- 43433 +--- 43434 | | image43434.jpg | 595 sectors | Photograph, DFRWS, Brian C. at his laptop | +--- 44028 +--- 44029 | | image41611.jpg (part 2) | 172 sectors | Spiral Galaxy M101 - Hubblesite.org | +--- 44200 [ 814 sectors total in uncarved region ] +--- 45015 | | zipfile45015.zip (part 1) | 372 sectors | | +--- 45386 [ 3 sectors total in uncarved region ] +--- 45390 | | zipfile45015.zip (part 2) | 156 sectors | | +--- 45545 [ 20 sectors total in uncarved region ] +--- 45566 | | image45566.jpg (part 1) | 398 sectors | "1565 80m coarse calc. sand" | +--- 45963 +--- 45964 | | msoffice45964.doc | 140 sectors | Farm Credit System Insurance Cop., Statement, March 31, 2006-Dec. 31 | +--- 46103 +--- 46104 | | image45566.jpg (part 2) | 723 sectors | "1565 80m coarse calc. sand" | +--- 46826 [ 83 sectors total in uncarved region ] +--- 46910 | | image46910.jpg | 47927 sectors | Photo shop image, Orange, "DFRWS 2006 Forensic Challenge" | +--- 94836 [ 9 sectors total in uncarved region ] +--- 94846 | | image94846.jpg (part 1) | 783 sectors | Saturn "Hubble Heritage" photo | +--- 95628 [ 1 sector total in uncarved region ] +--- 95630 | | image94846.jpg (part 2) | 1024 sectors | Saturn "Hubble Heritage" photo | +--- 96653 [ 1002 sectors total in uncarved region ] 97655 <<< END OF IMAGE . The tools and a description of the algorithms will be made available by July 17, 2006 at http://www.simson.net/ref/2006/s2-dfrws2006.tar.gz