After the Banquet at the annual conference, a "forensics rodeo" is held. The rodeo is a challenge where conference attendees form teams to solve a digital forensics problem.
The DFRWS is making the materials from the DFRWS 2009 Forensic Rodeo available for educational purposes and to support further research in memory analysis and file carving. We are not publishing answers to the Forensic Rodeo until DFRWS 2010 because disseminating such details could expose students to some findings before they have a chance to work on the problem themselves.
To maintain the educational value of this scenario, we request that everyone who uses these materials keep the answers to themselves until DFRWS 2010. We will post the answers here at that time.
The scenario and files are listed below.
The scenario, images, and any other supporting materials are distributed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 Unported License.
On July 25, 2009, police arrested Constantine Petersburg in Baltimore as part of a joint operation between law enforcement in Maryland, New Jersey and New York. He had just picked up a group of tired and hungry individuals who had arrived at Fort McHenry on a boat earlier that morning under the cover of darkness. Mr. Petersburg claims that he just happened to be driving around Fort McHenry in his van that morning, and offered the sorry looking group a ride. He refuses to answer any further questions and nobody in the group he picked up speaks English giving investigators very little to work with.
Fortunately, during the arrest, investigators found a HTC S620 “Dash” Windows Mobile device and laptop in Mr. Petersburg’s van that may contain relevant information. However, the investigators do not have the resources to perform a complete forensic examination of these items. They have requested your assistance in performing a forensic examination of the mobile device and e-mail acquired from the laptop. Specifically, you are being provided with an Outlook PST file copied from the laptop and an image of the data partition on the Windows Mobile device (acquired using XACT).
You have agreed to perform a forensic examination and are expected to answer the following questions, to include a full explanation with supporting evidence for each answer. Remember, an answer alone is not sufficient.
The DFRWS2009 Rodeo was created by Eoghan Casey.