Since I couldn't find any tools for extracting log entries, I ended up building my own. The challenge was to extract the contents. Keep in mind, I don't know if the DC3 didn't have a solution, wanted a better solution, or just thought that this would be a fun challenge. One of the challenges this year concerned Skype logs. Thus, I feel that I must make any custom software public. It is against my beliefs to give free software to the government. While I like the folks from the DC3, they are a government organization. It's that last item that always makes me think twice. You still own the copyright, but they have permission to use it. And if you make any software for solving a challenge, then you must turn in the code. If you use commercial software, then you don't have to provide it but you must say what you used. If you use an open source tool to solve any of the puzzles, you must turn it in with your solutions. The Challenge has one critical rule for getting full credit.
The winning team gets treated to the DoD's Cyber Crime Conference. In exchange for solving the problems, the highest scoring teams get serious bragging rights. They ended up getting 11 different solutions! (I think mine was the cheapest - double-back tape and super glue.) They didn't know how to get the data off of it. This was a CD-ROM that was physically cut. The first year that the DC3 held the Challenge, they had a problem that they didn't know how to solve. And a few of the challenges are because they don't know a solution. In other cases, they have solutions but are looking for something better. This way, if they come across some situation where their own solution does not work, they can use an alternative. For things that they know how to solve, they want alternate solutions. They want to collect tools and techniques. The DC3 actually has a (not so) secret agenda for the contest. The DC3 included some easy challenges, some moderate, and a few that were very hard. The 2008 DC3 Forensic Challenge has ended, but the results won't be posted for a few weeks.
0 kommentar(er)
