Saturday, January 22, 2011

Simple Forensic Puzzle #1

I recently had a need to make some simple forensic images for use with students. I decided to make one with some simple "anomalies" in hopes the students would pick up on them. So I figured I would share them and let others take a look to help refresh some foundational examination techniques.

The image linked below if fairly simple. A few files, not much more. But there are a few "anomalies" that should be detected and noted.

Download .E01 image here


Anonymous Wednesday, 16 March, 2011  

Not sure if I am on the right track, but here are a couple of things:

MBR partition table shows only 07 and one 06, but there are actually one 07 and two FAT 16's.

Relative position for 07 and 06 is the same: 1024000.

Size for 06 is zero.

Sector 63 does not have volume boot record.

Volume C and D appear to be almost identical, except the FAT for the D volume is about four times the size of C's FAT.

Lastly, volume E's $Bad Cluster is about 524MB, seems too large.


Lance Mueller Saturday, 19 March, 2011  


Yes, you are on the right track ;)

Unknown Sunday, 20 March, 2011  

Hello Lance,

I'm just downloaded E01. I'm gonna start

Anonymous Friday, 25 March, 2011  

I see a discrepancy in the volume file system and the partition ID as shown in the MBR.

C volume file system is FAT16 but MBR shows 0c (FAT32x)
D volume file system is FAT32 but MBR shows 07 (NTFS)
E volume file system is NTFS but MBR shows 06 (BIGDOS)


Anonymous Sunday, 04 September, 2011  

Hey Lance,


Can you create some for FTK as well

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles