Digital Forensics Challenge Treasure Hunt - Round 3

The third round of the Digital Forensics Challenge is now available! This challenge, written by the DC3 Challenge Team, requires participants to analyze a series of graphical image files (contained in a ZIP file) to answer questions. To participate, click the Question Engine link to the left, register, and make sure you enroll in the Digital Forensics Challenge Treasure Hunt - Round 3 quiz. If you don't close your browser between registering and clicking the link in the confirmation e-mail, it should remember which course you are enrolling in.


The Department of Defense Cyber Crime Center (DC3) has received a case on a possible espionage suspect from a federal law enforcement officer. The suspect, exiting a secured facility, was asked to halt and took off running in a parking lot, where he was stopped. Returning to the building with the suspect, following the same path he ran, three USB flash drives were found in the grass at the base of a light post. After the suspect's seized laptop imaged, its hard drive is reviewed by a DCFL computer forensic examiner. The examiner is providing a set of 30 files from the laptop that have been selected being similar to the files noted on the USB flash drives. The files recovered from the laptop are stored in a single directory named 'Files_From_Hard_Drive'. The examiner is also providing the files found on the three USB flash drives in separate directories named 'Files_From_USB1' (4 files), 'Files_From_USB2' (13 files), and 'Files_From_USB3' (4 files).

With your knowledge and skills, the examiner has provided you with a copy of the selected laptop files and the files from the three USB flash drives. They have asked if you can determine, with reasonable forensic certainty, if any of the provided laptop files may match files from the USB flash drives. The investigating officer says that although some of the pictures look the same between the laptop and the USB flash drives, that is not certain enough to say the pictures are the same and cannot establish the suspect had the USB flash drives and threw them down while running. In addition, the law enforcement officer that submitted the case has several questions he wants answered for his report and to increase his general knowledge.

Click here to download the ZIP file containing the images to analyze.
SHA1: 79bf34007aabb760411d6dfd89ed203f9d1d08d6


Sponsored by the DC3 Digital Forensics Challenge.
Sign up now for the 2010 DC3 Digital Forensic Challenge at http://www.dc3.mil/challenge/2010 for more digital forensics challenges!
Privacy Policy