The plans to a secret weapon were found on a USB Key in a parking lot outside a military installation that uses only default installations of Windows 7. During initial examination of the files on the USB key, the investigator had some questions that they were hoping that you might be able to answer. The investigator provided a screen capture of the files and the modified, accessed, and created times of the files on the USB Key. Using only the screen capture as evidence, please answer the following questions. HINT: Default installations of Windows 7 will have the last access time disabled. This challenge was written by Rob Lee of the SANS Digital Forensics Team. On the morning of July 13th at 0900 hours, a young woman was reported missing. The victim's roommate notified law enforcement, stating the victim had gone out to dinner with friends the previous night and had not returned by the following morning. The victim's friends told law enforcement that she had left dinner shortly before midnight. The victim's cellphone was later recovered from a park near where the victim's car was parked. Law enforcement officials have retrieved an image they believe is of the suspect vehicle. Law enforcement is requesting your assistance in answering specific questions. With your knowledge and skills, the examiner has provided you with an exact copy of the selected image collected from the mobile device. They have asked if you can determine, with reasonable forensic certainty, any details that you can determine from the picture collected from the mobile device. In addition, the law enforcement officer that submitted the case has several questions he wants answered for his report and to increase their general knowledge. This challenge was written by Mike Murr of the SANS Digital Forensics Team. The Department of Defense Cyber Crime Center (DC3) has received a case on a possible espionage suspect from a federal law enforcement officer. The suspect, exiting a secured facility, was asked to halt and took off running in a parking lot, where he was stopped. Returning to the building with the suspect, following the same path he ran, three USB flash drives were found in the grass at the base of a light post. After the suspect’s seized laptop imaged, its hard drive is reviewed by a DCFL computer forensic examiner. The examiner is providing a set of 30 files from the laptop that have been selected being similar to the files noted on the USB flash drives. The files recovered from the laptop are stored in a single directory named 'Files_From_Hard_Drive'. The examiner is also providing the files found on the three USB flash drives in separate directories named 'Files_From_USB1'(4 files), 'Files_From_USB2'(13 files), and 'Files_From_USB3'(4 files). With your knowledge and skills, the examiner has provided you with a copy of the selected laptop files and the files from the three USB flash drives. They have asked if you can determine, with reasonable forensic certainty, if any of the provided laptop files may match files from the USB flash drives. The investigating officer says that although some of the pictures look the same between the laptop and the USB flash drives, that is not certain enough to say the pictures are the same and cannot establish the suspect had the USB flash drives and threw them down while running. In addition, the law enforcement officer that submitted the case has several questions he wants answered for his report and to increase his general knowledge. Sponsored by the DC3 Digital Forensics Challenge.Privacy Policy The Department of Defense Cyber Crime Center (DC3) has received a request for a digital forensics exam from a Defense Criminal Investigative Organization. After the SUBJECT of the investigation's seized laptop was imaged, its hard drive is reviewed by a DCFL (Defense Computer Forensics Lab) computer forensic examiner. The examiner identifies a set of 13 files that have been marked as suspicious in a single directory. With your knowledge and skills, the examiner has provided you with a copy of the 13 suspicious files and asked you to identify the file signatures for each file. In addition, the agent that submitted the case has several questions they want answered for their report and to increase their general knowledge. Sponsored by the DC3 Digital Forensics Challenge.Privacy PolicyPublic access to the original Web Vulnerability Assessment Security Treasure Hunt.
If you are with a specific group or state then please refer back to your specific organization's quiz.
Contact us at registration@securitytreasurehunt.com if you have any questions.
Please do not ask for assistance with the questions on the quiz.
NROTC Scholarship. For more information about applying, e-mail nrotc@uscyberchallenge.org or visit www.uscyberchallenge.org.
| This is the question engine for the Security Treasure Hunt. |
