Any ideas on the program responsible?

From: Dave Ausdenmoore (aussieat_private)
Date: Thu Oct 18 2001 - 10:37:44 PDT

  • Next message: H C: "NT/2K Forensics Server Project"

    I need a sip from the fountain of collective wisdom -
    
    I have a suspect, who's abilities are considered near expert and is a
    programmer where he worked.
    
    He's admitted the child porn involvement, and wiping removable media, but
    during
    the search of his office I located a SCSI hard disk in a static bag.
    
    The hard disk contains only hex 00 on the entire disk, except for 4 bytes in
    sector 0/0/1.
    Starting at offset 0220 of 0/0/1 there are the characters, in hex,
    81 57 53 10 which looks like WS. in ASCII.
    
    Anyone have an idea of what might have left / or caused this data to
    appear on the disk?
    
    Thanks in advance - the issue is not urgent.
    
    aus
    
    Dave Ausdenmoore                      513.946.6688 (office)
    1000 Sycamore St. Rm 110        513.470.0986 (cellular)
    Cincinnati, Oh 45202                  513.269.1336 (pager)
    daussieat_private (personal)           aussieat_private (business)
    
    "Keep your focus on Providence, and Fear nothing"
    - Kyriacos C. Markides, on the Attack on America, 10/1/2001
    
    
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Oct 18 2001 - 12:31:44 PDT