DEFCON 2013 Network Forensics Puzzle Contest

"WARNING: This contest contains off-color humor and bad accents which may not be appropriate for the classroom, children, rodents, etc."

Introduction: Jack Stone has been retired from the Agency for nearly 7 years. After his retirement Jack found himself looking to bring some adventure back into his life. Jack got himself a private investigator license and opened his own firm. Rock Solid Investigations, LLC. has been solving interesting and complex cases for nearly 3 years. Jack's business has grown to include his former partner Timothy Jones and his newest hire, you, a professional forensic analyst. Together the staff at Rock Solid Investigations has over 50 years of investigative experience. Rock Solid is one of the most sought after PI companies in North America. However, all of their success and experience could not prepare them for what lay ahead. It was a usual Tuesday afternoon at Rock Solid. Jack was on the phone talking to potential clients, Tim was out on recon, and you were using e-discovery techniques to track down a runaway bride. Just then a strange woman walked in the front door. Jack finished his phone call and greeted the visitor. Victoria Jensen hired Rock Solid to determine whether or not her husband Gregory Jensen was cheating on her. Gregory was the CEO of Impressive Dynamics a company specializing in technology and weapons invention and manufacturing. Impressive Dynamics holds many DoD and other government contracts. This case would not be low profile. The firm has hired you as a forensic investigator to investigate the alleged affair. Can you solve the case?

Here's a link to the contest :

Contest

MD5 CHECKSUM:


Contest: 53ade24d35a513a78183ef4822ee094d

How to Mount the Truecrypt Volume:

1)Make sure Truecrypt has been installed on your system, and open it.
2)Select an empty slot in the Truecrypt window to mount the encrypted volume.
3)Click "Select file" and browse to the location where the encrypted volume is stored.
4)Select the volume (i.e. round#) and click "Mount".
5)Enter the password and click "OK".

A few notes:

1. You will not get the correct answer simply by running "strings" on the packet captures. It is more complicated than that.
2. Please do not attempt to brute-force the answer by guessing. We reserve the right to cut you off from submitting answers if you abuse the privilege.
3. There are eight contest rounds containing eight evidence files. You must analyze the evidence files in order to answer the question(s) which go along with each capture. The answers to those questions will be used to unlock the next round of the contest.

Have fun! :)


This puzzle was created by Scott Fretheim, Brett Larsen, Ross Miewald, and Randi Price (LMG Security).

Copyright 2013 LMG Security. All rights reserved.