To complete this challenge, the following tools were used:
The scan26.zip file was downloaded from the Honeynet website and the MD5 value was verified. The zip file was then unzipped and the scan26 image was extracted and the MD5 sum verified.
Autopsy 1.70 was started and a new case was created. The case name was jimmyjungle, the description was Supplier for Joe Jacobs, and the investigator was carrier (screen shot).
Inside the jimmyjungle case, a host was created called floppy, the description was Floppy disk found at residence, and the timezone was set for EST5EDT. Since this was not from a specific system, the clock skew can not be supplied and we do not have any hash databases for this case. (screen shot)
Inside the floppy host, the image was added by selecting "Add Image" and moving the scan26 file to the jimmyjungle/floppy/images directory. The file system type was fat12, the mounting point was A:\, and we can add the known MD5 value of e9c7d0c87ab0ecce09bf90362b830a74. Check the "Verify Before Adding Image" box to verify the image integrity again (screen shot).
The first step in our analysis was to get the quick and obvious pieces of evidence. A more comprehensive analysis was later performed to fill in the holes.
The first and most obvious step was to examine the file contents of the image. This was done with the 'File Analysis' mode in Autopsy. As shown in the screen shot , there were no files in the root directory. So much for the obvious quick hits.
Based on the previous step, we had either a blank floppy, or a floppy with only hidden information. The 'Image Details' mode in Autopsy gave us more insight about what we were dealing with (screen shot). This view showed the following data that may be important later.
The Primary and Secondary FAT were examined to verify what was being seen. The 'Data Unit' mode was used to show the contents of sectors 1-9 (Starting Sector #1 and length of 9). Using the Hex view we were able to see data in the first 24-bits (which were reserved) and the remainder was all 0's (screen shot). The Secondary FAT (Starting at #10 with a length of 9) was the same. Therefore, all sectors were set as unallocated.
Next, the Root Directory area was examined. The 'Data Unit' mode was used again and sectors 19-32 were viewed (starting #19 and length of 14). Using the hex view, it was obvious that this was also full of 0's.
So far, this looked like an empty floppy, so that Data Area Area (sector 33) was examined. Using the 'Data Unit' mode, it was observed that the 'File Type' of sector 33 was JPEG image data and the the JFIF header value was observed (screen shot).
% ils -f fat12 -e scan26
This output showed that no other directories exist in the image except for the root directory, which was empty.
|Data File #1|
The strings were also extracted from the unallocated space. This was done with the 'Extract Strings' button.
|Data File #2|
Doing a quick examination of this file from the command line showed uninteresting ASCII strings until the end of the image.
% less output/scan26.dls.str
31777 " ""
31782 " ""
31787 " ""
1385824 John Smith's Address: 1212 Main Street, Jones, FL 00001
At byte offset 1210704 of the scan26.dls image the string pw=help was found. This translated to sector 2364 of the unallocated space image. To identify the sector in the original image and to view the entire sector, Autopsy was used in Data Unit mode. Autopsy translated sector 2364 of the unallocated image to 2397 of the full image. The sector was filled with 0xf6 besides the identified string.
At byte offset 1385824 of the scan26.dls image the string John Smith's Address: 1212 Main Street, Jones, FL 00001 was found. This translated to sector 2706, (1385824 / 512), of the unallocated space image. When viewed in Autopsy, the contents of sector 2739 in the original image were shown. As with the other sector, it was filled with 0xf6 in all bytes not used by the address.
|String:||John Smith's Address: 1212 Main Street, Jones, FL 00001|
% mkdir foremost
% foremost -o foremost scan26.dls
'foremost' found one 32602-byte data file that began at the start of the scan26.dls file. It can be found here. The 32602-byte picture was calculated to occupy 64 sectors (((32602 + 511) / 512) = 64 sectors).
|Data File #3|
The picture showed a map with an X at Danny's Pier 12 Boat Lunch on Shore Line Drive.
|Location:||Danny's Pier 12|
Autopsy was used to view the next sector of the disk to see if the file type was known. In the 'Data Unit' mode, 64 was entered and the 'Unallocated' type is selected. This showed sector 97 of the original file system image with a file type of PC bitmap data, Windows 3.x format, 720 x 540 x 24 (screen shot). If this was indeed a bitmap image, we were unsure of the total size of it. ('foremost' does not come with the configuration settings to identify bitmap pictures).
To find the end of the bitmap, additional file types were searched for. A quick Perl script was written that ran the 'file' command on each sector. This allowed us see if there was a new file type in the image. The output showed no other interesting file types.
As a first guess for the ending of the bitmap, the sector where the 'pw=help' string was found was used, sector 2706. Recall that the contents of this sector were all 0xf6, except for the string. The 'hexdump' tool was used to find out where 0xf6 started.
% hexdump scan26 | tail -15
0128e50 ffff fefe fefe ffff feff feff ffff fefe
0128e60 fffe feff feff ffff fffe ffff feff fffe
0128e70 fffe fefe fffe f6f6 f6f6 f6f6 f6f6 f6f6
0128e80 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6
012bb50 7077 3d68 656c 70f6 f6f6 f6f6 f6f6 f6f6
012bb60 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6
0156760 4a6f 686e 2053 6d69 7468 2773 2041 6464
0156770 7265 7373 3a20 3132 3132 204d 6169 6e20
0156780 5374 7265 6574 2c20 4a6f 6e65 732c 2046
0156790 4c20 3030 3030 31f6 f6f6 f6f6 f6f6 f6f6
01567a0 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6 f6f6
The 0xf6 started at offset 0x0128e76 (1216118 in decimal), or sector 2376. The 7077 values at 0x012bb50 corresponded to the 'pw' letters. The data was extracted with 'dd':
dd if=input/scan26 skip=97 count=2279 of=output/sector97.bmp
|Data File #4|
The picture shows a map that is similar to the previous JPEG image, except that it also contains an X at 22 Jones Avenue that says Hideout.
|Location:||22 Jones Ave - Hideout|
So far, we have recovered two maps that show a hideout (Finding #4) and Pier 12 (Finding #3). We also found a string for 'pw=help' (Finding #1) and the address of John Smith (Finding #2). The remainder of the disk was 0xf6.
The only suspicious result was the password, which has not been used yet. Since we only have pictures, there could be additional data hidden in the pictures using steganography. 'stegdetect' was used to analyze the JPEG image.
stegdetect -n output/foremost/00000000.jpg
output/foremost/00000000.jpg : invisible(***)
The 'invisible' shows that the 'Invisible Secrets' tool was used to hide data in the JPEG photo. The picture was imported into the Invisible Secrets tool and the 'help' password was used, the program said that it was an incorrect password.
To identify other password options, the police report was consulted for clues. The floppy disk had 'dfrws.org' written on it and the Joe Jacobs police report had a document that said that the 'goodtimes' password was the same as the "previous file". Both of those passwords were tried and were unsuccessful.
After receiving an "anonymous" tip, the actual dfrws.org website was examined. The site appeared normal, but two passwords were found upon viewing the HTML source. They were 'lefty' and 'right'.
The 'lefty' password was used with the Twofish decryption algorithm and the John.doc file was extracted.
|Data File #5|
When opening this in Microsoft Word a password was required. The 'help' password was used and opened the document. Its contents can be found here. The document showed the following:
|Relationship:||Joe Jacobs was indeed a dealer for Jimmy Jungle|
|Relationship:||John Smith was the supplier for Jimmy Jungle|
|Relationship:||Danny's Pier was used for pickups|
|Location:||Jimmy Jungle is hiding out|
|Location:||John Smith had a condo in Aruba|
We still have one more password left though, 'right'. The bitmap photo could not be tested with stegdetect, but Invisible Secrets supports bitmaps. It was imported and the 'right' password was used. The result was Jimmy.wav, which can be found here.
|Data File #6|
The wav file contains Jimmy Jungle speaking instructions for a meeting tomorrow at the pier.
|Event:||Meeting at the pier tomorrow with Jimmy Jungle|
|Location:||Jimmy drives a 1978 Blue Mustang with Ontario plates|
We have finally exhausted the available data from the floppy and handed the data to the police. Hopefully, they will be ready for the meeting at the pier.
Who is the probable supplier of drugs to Jimmy Jungle?: From the document extracted, John Smith was the probable supplier of drugs.
What is the mailing address of Jimmy Jungle's probable drug supplier?: From the unallocated space on the disk, the following address was found:
1212 Main Street
Jones, FL 00001
What is the exact location in which Jimmy Jungle received the drugs?: According to the extracted document and maps, the drugs come in via boat to Danny's, which was on Pier 12.
Where is Jimmy Jungle currently hiding?: From the extracted document and recovered bitmap, Jimmy was at 22 Jones Ave.
What kind of car is Jimmy Jungle driving?: 1978 Blue Mustang with Ontario Plates.
Bonus Question: The root directory and FAT were wiped and the data area was not because the disk had been "Quick" formatted.