|
Forensic Practical Exercise #3 |
 |
 |
 |
|
Written by Lance Mueller
|
|
Saturday, 02 January 2010 22:19 |
So I figured many of you may be on vacation and would like a little puzzle to work on during your free time ;)
Scenario:
Your company has been contacted by a very wealthy and prominent business. They have one simple request. They would like you to do some data recovery and recover one simple file. The President of the company explains that he has a USB flash device that contained one simple file and that when he gave it to the company accountant (who uses a MAC), the drive suddenly became unreadable. The President advises you that the file contains the account number of a very important bank account and that he needs that 18 digit account number. Nothing else matters to him.
The file is *very* important and he is willing to pay you whatever fee you demand if you are able to recover the file exactly as it was.
Your mission, if you choose to accept it, is to recover the file and be able to tell the President (me) the account number (via email, please don't spoil it and post it in the comments, send to lance(at)forensickb.com).
Extra Credit:
Can you hypothesize as to what happened to make the file "disappear"?
Can you articulate the status of the drive and what, if anything is different that a typical flash disk?
Provide the MD5 of the recovered file.
I will provide an exact explanation of what was done to the device and file to those who submit answers so you can compare it with what you see.
There is no encryption or hidden elements to this problem. This is a classic puzzle. For this scenario, I will be the "President" who lost the data and has contacted you. Feel free to "interview me" and ask any further information that you feel necessary, via the comment section (so everyone can benefit).
Good Luck!
Download Here (7.5MB)
Posted: 2010-01-03 03:19:00 |
