DC3 2009

Print Friendly


There are two maps included in the evidence directory. They have a red X denoting the warehouse location with instructions for getting there, and for the meetup location after the robbery. One of the maps has obscured the location labeled “Lane Plaza” and added a red pathway.


There are a number of pictures of assault weapons on the system. These pictures are located with a saved copy of www.gunmallusa.com and appear to be from a page archive.

There are two files with hidden images of weapons. The files “store list.xls” and “vacation.ppt” are provided in the evidence directory. The file “Screenshot-vol4-E..Users.Master.of.Disaster.Desktop.store.list.xls – Guns Revealed.png” is a screenshot of the spreadsheet with the images expanded.

In the powerpoint presentation there is an image hidden behind another on the last slide. This image is exported as “vacation.ppt_extractedimage.png”; note it has a caption “B – you look mighty fine holding this stolen rifle! Good thing no one can see your face – for now… Pay what you owe if you don’t want me to show anyone!” This indicates blackmail of some sort is going on.

An export of the gun images is included in the guns subdirectory of the evidence directory.

Crystal Clocks

The Documents specifically mentions Stallman’s obsession with pictures of crystal clocks, and his comments about hiding data in the same breath.

Clocks were hidden in the following locations

  1. C://System Volume Information/_restore{2906B87C-A85F-43CD-91FA-1C1B08CE54E2}/RP31/log.ini


  3. D://WINDOWS/place.sys

  4. D:/NVIDIA/Win2k/174.74/English/Readme.txt

  5. E://Windows/control.dat

These clocks are located in the evidence folder under clocks. We performed file carving on the image as well to locate any additional clocks resulting in 1 other unduplicated clock The clock files are all around 46k. Each image has a small plain text message appended to the end, they are as follows:

  • CC1.MDB -> This is the key clock in the series. If you do not recieve this key clock from me, then all of the other clocks information may be a setup, so get out of town.

  • Readme.txt -> The first set of weapons is stored at 1913 Amee Ave. Its an apartment building, in the basement, behind the waterheater in the utilities closet (Which is unlocked)

  • place.sys -> Check this picture for the time that we meet at the wharehouse this morning AM with the equipment, ready to go, to get rich. Remember this clock tells you the time to meet me there, don’t mess up.

  • 04318067.jpg -> Second set of weapons with some of the explosives is stored under the back yard shed at 124 Allicia Anne Ave over on the west side of town. Be careful of the dog in the yard, it’s a mean one.I solve

  • control.dat -> The last stash of weapons and the rest of the explosives is stroed in the junker car at the corner of Elm Ave and Highland St. Look in the trunk under the carpet in the spare tire well under the trash.

  • log.ini -> Meet me at the time on this clock PM at that empty lot near my moms house and we’ll split the take and talk about how to sell and fence the items off without getting caught. Make sure your not followed.

Note that the log.ini clock show 9:00 on the face. Each clock image has a different time.

Posted in Digital Forensics Tagged with: , , , , ,