Forensic Mission 2

Learn to recover deleted files, analyze evidence, and see beyond the immediately obvious.
Forum rules
DO NOT POST ANSWERS OR SPOILERS! [IE: Mission Links, Mission File Names/Pages, Scripts, etc.]
Posting these will result in warnings/bans!

Forensic Mission 2

Post by limdis on Sat Apr 23, 2016 2:09 pm
([msg=92193]see Forensic Mission 2[/msg])

Requirements:
Google

You cannot solve this mission by looking for the obvious signs of a poorly photoshopped image. You will need to have an understanding of jpeg compression levels. Once you realize what you need to do the answer will virtually glow at you. For those that complete the challenge and wish to help others, be as descriptive as possible but do not post the actual name of the technique.

Do not post spoilers!
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1657
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by Zeb139 on Fri May 20, 2016 8:47 am
([msg=92327]see Re: Forensic Mission 2[/msg])

Dear future readers,

If you have no idea where to start, read up on this "jay-peg" stuff: https://en.wikipedia.org/wiki/JPEG
Next, notice how you'll need a password to solve this puzzle. If I were a password, where would I hide inside an image?
Can't say much more without giving it away, really. If you were to read, I dunno, 1/4 of the wiki page, you'd likely find a bit that will lead you on the right path.

A question about the photo: Would it be possible to learn what modifications were done to the woman in the photo? I have evidence that suggest she was not present in the original photo, but I feel like editing her into the photo would have been a lot of work (especially considering how convincing it looks). I suppose I'd just like to know how the modified image was produced ^__^
Zeb139
New User
New User
 
Posts: 2
Joined: Thu May 19, 2016 9:27 am
Blog: View Blog (0)


Re: Forensic Mission 2

Post by limdis on Fri May 20, 2016 3:56 pm
([msg=92328]see Re: Forensic Mission 2[/msg])

Zeb139 wrote:A question about the photo: Would it be possible to learn what modifications were done to the woman in the photo? I have evidence that suggest she was not present in the original photo, but I feel like editing her into the photo would have been a lot of work (especially considering how convincing it looks). I suppose I'd just like to know how the modified image was produced ^__^


It was a lot of work. I wanted to make the image so convincing that you HAD to use additional techniques outside of pointing out the obvious defects of a poor photoshop. Unfortunately, determining specifics on what was actually done to the image is almost always going to be unknown. With this particular image you may have noticed "rainbowing" which is a byproduct of the image being resaved from photoshop (which it was). With the same technique used to complete this challenge you may have also noticed a grid like pattern. Some sections of the image may have been rotated, and it is usually obvious in comparison. Other editing software may leave evidence in metadata and I once saw the name of a beautify script left in the hex as a way to watermark itself. Also, in a real case the physical device used to take the picture would be requested as moving images from the original device causes contamination. If possible, a test image is taken with the device and is compared against the evidence presented to help determine the validity of the claim. All that said, unless it is blatantly obvious, the only thing that can be stated in court is the professionals opinion. It is up to the jury to decide based on that if the picture is fake or not.
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1657
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by hellow533 on Fri May 27, 2016 1:24 pm
([msg=92381]see Re: Forensic Mission 2[/msg])

Of course, it's Limdis so obviously something has to be broken.

This took me way longer than it should have...
“Teach me how to hack!”
"What, like, with an axe?"
User avatar
hellow533
Contributor
Contributor
 
Posts: 535
Joined: Thu Jan 29, 2009 3:27 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by limdis on Sat May 28, 2016 1:52 am
([msg=92385]see Re: Forensic Mission 2[/msg])

hellow533 wrote:Of course, it's Limdis so obviously something has to be broken.

Image
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1657
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by RaThE_Waz_Here on Sat May 28, 2016 2:06 am
([msg=92386]see Re: Forensic Mission 2[/msg])

First sign of alteration would be lack of metadata from the iphone in the picture, but that seem like a dead end in this case as this mission is asking for a password, kinda at a loss after having a run at it with the usual tools..
RaThE_Waz_Here
New User
New User
 
Posts: 3
Joined: Mon Jun 04, 2012 9:44 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by hellow533 on Sat May 28, 2016 1:27 pm
([msg=92387]see Re: Forensic Mission 2[/msg])

You know, this feels more like a stenography mission than a forensic one. Should it be moved there?
“Teach me how to hack!”
"What, like, with an axe?"
User avatar
hellow533
Contributor
Contributor
 
Posts: 535
Joined: Thu Jan 29, 2009 3:27 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by limdis on Sat May 28, 2016 3:28 pm
([msg=92388]see Re: Forensic Mission 2[/msg])

hellow533 wrote:You know, this feels more like a stenography mission than a forensic one. Should it be moved there?

No. What this mission is about is detecting if an image has been manipulated, not searching for hidden text. The only thing that could classify this as also being a stego challenge is because of I had to put in text so that the user could complete this without me having to review their findings. Forensics and stego are siblings, true. But this method in my honest opinion would not be worth the effort for attempting to communicate secretly. It's too easy to detect and honestly... it was serious pain to manipulate text into it without it being seen.
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1657
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by RaThE_Waz_Here on Sun May 29, 2016 8:56 pm
([msg=92391]see Re: Forensic Mission 2[/msg])

Massive sigh moment when you find it.
Great work on the image! :)
RaThE_Waz_Here
New User
New User
 
Posts: 3
Joined: Mon Jun 04, 2012 9:44 pm
Blog: View Blog (0)


Re: Forensic Mission 2

Post by anonianti on Thu Jun 16, 2016 4:25 pm
([msg=92488]see Re: Forensic Mission 2[/msg])

I can't imagine this will be breaking rules. Just trying to save people the minor frustration I experienced.. Password is case sensitive and the mystery characters are *not letters*.

BTW, enjoyed the mission. Thanks!
User avatar
anonianti
New User
New User
 
Posts: 3
Joined: Thu Aug 14, 2014 3:59 pm
Blog: View Blog (0)


Next

Return to Forensic

Who is online

Users browsing this forum: No registered users and 0 guests