COEN 152/252 Computer Forensics
Syllabus Laboratories Lecture Notes Instructor

First Takehome Midterm

Identify and retrieve as many jpeg images from the following disk image: carving challenge

What can you say about the path of the following message

x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensgcv5hR2t8QCnA1mtJyHzIrI8k1oo3BhzvDOc4UQBDLXfBnzeuODG8fvzWMgtTVhQZrg6x4GNPYqF0lmotM7VdDckh35qTkPhKxekCMy53s0=
Authentication-Results: hotmail.com; spf=permerror (sender IP is 65.116.151.141) smtp.mailfrom=owner-sigmetrics-members*tschwarz**CALPROV*-ORG@LISTSERV.ACM.ORG; dkim=none header.d=NET.T-LABS.TU-BERLIN.DE; x-hmca=none
X-SID-PRA: SIGMETRICS-MEMBERS@LISTSERV.ACM.ORG
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: aKlYzGSc+LntszwVaofz59OPliTwO9Y7UYjRgfEni7qb6rs8yU45c+YemXMLQjISGPp7mzdiout8ptJ75Hz9n3wubAqSeiKKgjBl/SpBDun4OLC7OZns3UPGEfJay5StqdYDbU6nPWzT0D8HOa4kIVl/cmRV/XDC
Received: from MAIL.CALPROV.ORG ([65.116.151.141]) by SNT0-MC2-F42.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Tue, 29 Jan 2013 04:43:54 -0800
Received: from acm-x.mta.lsoft.us (209.119.5.133) by SCAMXSFE.calprov.org
(10.1.10.22) with Microsoft SMTP Server id 14.2.328.9; Tue, 29 Jan 2013
04:43:53 -0800
Return-Path: <owner-sigmetrics-members*tschwarz**CALPROV*-ORG@listserv.acm.org>
Received: from [209.119.5.151] ([209.119.5.151:53771] helo=LOIRE) by
lychee-msg (envelope-from
<owner-sigmetrics-members*tschwarz**CALPROV*-ORG@listserv.acm.org>)
(ecelerity 3.2.2.42971 r(42971)) with ESMTP id 6A/B4-02532-904C7015; Tue, 29
Jan 2013 07:43:53 -0500
Received: by LISTSERV.ACM.ORG (LISTSERV-TCP/IP release 16.0) with spool id
83209147 for SIGMETRICS-MEMBERS@LISTSERV.ACM.ORG; Tue, 29 Jan 2013
07:43:52 -0500
Approved-By: cslui@CSE.CUHK.EDU.HK
Received: from psmtp.com (na3sys009amx179.postini.com [74.125.149.160]) by
LOIRE.EASE.LSOFT.COM (SMTPL release 1.1c) (envelope-from
<florin@net.t-labs.tu-berlin.de>) for
sigmetrics-members@listserv.acm.org with TCP; Tue, 29 Jan 2013
07:27:49 -0500
Received: from mail.net.t-labs.tu-berlin.de ([130.149.220.252]) by
na3sys009amx179.postini.com ([74.125.148.10]) with SMTP; Tue, 29 Jan
2013 04:27:48 PST
Received: from FlorinPC (storch.net.t-labs.tu-berlin.de [130.149.220.79]) by
mail.net.t-labs.tu-berlin.de (Postfix) with ESMTPSA id 2623C4C3D8A
for <sigmetrics-members@listserv.acm.org>; Tue, 29 Jan 2013 13:27:47
+0100 (CET)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: Ac3+GiJNXXEKS7hVRReAk+olSM1hew==
Content-Language: en-us
X-pstn-neptune: 0/0/0.00/0
X-pstn-levels: (S:33.34837/99.90000 CV:99.9000 FC:95.5390 LC: 0.1839
R:95.9108 P:95.9108 M:94.9308 C:98.6951 )
X-pstn-dkim: 0 skipped:not-enabled
X-pstn-settings: 2 (0.5000:0.5000) s cv gt3 gt2 gt1 r p m c
X-pstn-addresses: from <florin@net.t-labs.tu-berlin.de> [160/11]
Message-ID: <08fa01cdfe1c$0ea66e20$2bf34a60$@net.t-labs.tu-berlin.de>
Date: Tue, 29 Jan 2013 13:27:51 +0100
Reply-To: Florin Ciucu <florin@NET.T-LABS.TU-BERLIN.DE>
Sender: ACM SIGMETRICS-MEMBERS List <SIGMETRICS-MEMBERS@LISTSERV.ACM.ORG>
From: Florin Ciucu <florin@NET.T-LABS.TU-BERLIN.DE>
Subject: 25th International Teletraffic Congress (ITC-25) [Last CFP]
To: <SIGMETRICS-MEMBERS@LISTSERV.ACM.ORG>
Precedence: list
List-Help: <http://listserv.acm.org/scripts/wa-ACMLPX.exe?LIST=SIGMETRICS-MEMBERS>,
<mailto:LISTSERV@LISTSERV.ACM.ORG?body=INFO%20SIGMETRICS-MEMBERS>
List-Unsubscribe: <mailto:SIGMETRICS-MEMBERS-unsubscribe-request@LISTSERV.ACM.ORG>
List-Subscribe: <mailto:SIGMETRICS-MEMBERS-subscribe-request@LISTSERV.ACM.ORG>
List-Owner: <mailto:SIGMETRICS-MEMBERS-request@LISTSERV.ACM.ORG>
List-Archive: <http://listserv.acm.org/scripts/wa-ACMLPX.exe?LIST=SIGMETRICS-MEMBERS>
X-Brightmail-Tracker:
H4sIAAAAAAAAC1VSbUhTYRjtvbt3u47denUrn4ZS3DIjdVhSFhko+UFZpkkUBums5Ua6jU1Tf1RTSEIN8wOr6UxTCgwdmaKifbAMVtIPFQIZpqEWmk4NFRTLdnfV7N95nnPe8xwOLy3wmqVYoZjsy6buBol7RAnBb2tmComjMy/vi8JR/JYkSqNN1eWkUOrF2W5KPx6YUzpVQ5nQlF8hEtNeuAFB27suYSHycA3nwO4YpHiihIDi8QIhP7QgGKr4jjgVwiws1ztJnqgnoHd0BfGDFYHjhVPEe+UR8KxIyWEGe8LHx2MkhwU4EGq7fgl5vAvap6sFHAa8Gzo+/3RfkGEFPG/6TfAab5j40CPiNXIoKyt3RwKcj2CuuGCNYKF1fHHN6Dj0VtgpHodDZd5Tl4Z2hYiCKucdbk1iP3jfvIz4nKGwtNLtxlJ8Cibsc25LIQ6BZsv6PhJMQ1aCs5Fhf5gqkXBrjDHUNHQSXBwJrkPQudDnPivB58HayL+V4DgwDXwjeBwOzpk6IecjwRdgYWzPA7TfvKkh86aGzJsaMm9qohaRjUiWeDLi7KXE6CjFVWW63qC7qdAZ0lqQ6x+IkXhHB1pcOWZDO2mC3c6MdYsSvLam6q7lqpVGdbIhK11ltCGgJayM8bG5OMaoV2YYNWnrlA9Ns8Bc4ShPgypNlXNdk56pMvD0JxREmy1FP5AXqdVpVXJv5gQnxJyHOku7oVv/kv3IVy5lUt+4NBK9ypChyfyfn0TeNGKljIJzkWi0mRtBJl0ZCVfGQwXujJnKf5TchBrkEYKHKfTt5LjYSNtp30elPuLgaEY/EhnwJVdXY2ptmxbKQyuzh6UFS3mvy1MsKx4X907G3LO+ml/Ah0lHbX+1dT6gbYTF8c6wJFylmL9x5tZqUcxAkn/+UuPldjbLEWu3CZ+IBhMdAW2JR6pD/kTu09PbmlajY79ahsNGWdKoVh48IDAYlX8BzaFLgYMDAAA=
X-OriginalArrivalTime: 29 Jan 2013 12:43:54.0964 (UTC) FILETIME=[4C817940:01CDFE1E]
2013 Thomas Schwarz, S.J., COEN, SCU SCU COEN Computer Forensics T. Schwarz
These documents are not intended for dissemination beyond SCU.        CAVEAT LECTOR