Comments on: Contest #6 HINT!

By: sherri

sherri — Thu, 08 Jul 2010 16:28:56 +0000

Hi guys, we’ll also be publishing the winners and the winning solutions here at forensiccontest.com tonight. Cheers!

Sherri

By: webcast info

webcast info — Thu, 08 Jul 2010 03:05:56 +0000

If anyone is interested to listen to it live:

July 8th 6:30 EST
https://www.sans.org/webcasts/forensic-challenge-winners-presentation-93648

By: sherri

sherri — Thu, 08 Jul 2010 01:52:35 +0000

Yep, feel free to share! The contest is closed, and we will be announcing winners tomorrow.

By: Eric

Eric — Fri, 02 Jul 2010 02:57:38 +0000

Deadline is 6/27/10 (11:59:59PM UTC-11) (In other words, if it’s still 6/27/10 anywhere in the world, you can submit your entry.)

—

Up to you if you think you can post your answers.

By: Francesco Acchiappati

Francesco Acchiappati — Wed, 30 Jun 2010 11:40:54 +0000

Are submissions closed?
on the rules it says it’s not allowed to share/publish the solution before the deadline.

are we now allowed to share or we have to wait for an official announce?

By: vleskov

vleskov — Tue, 29 Jun 2010 05:00:53 +0000

Thanks for posting your writeup Eric and linking it here. It’s nice to be able to compare answers before the official ones are published. I’d like to say your answers are 100% correct. But I can’t say for certain =)

By: Eric

Eric — Mon, 28 Jun 2010 21:03:43 +0000

My writeup on contest #6, can’t guarantee it is 100% correct, but, if you’re bored, have at it.

By: sherri

sherri — Mon, 28 Jun 2010 04:32:18 +0000

Hi there,

Yes, please resubmit. We will look at the latest version of your submission.

best,
Sherri

By: CarP

CarP — Fri, 25 Jun 2010 11:56:31 +0000

Hi,

i’m one of those who ran foremost directly against the capture file and got 2 wrong files with exactly the md5sums you mention.

I’d like to correct my solution, as i (think) have succesfully extracted the correct files. And yes, they have the same md5sum, so after what you said, i guess now i’m right.

Do i have to submit again my solution? or is there any way to change it?

I think i will have to submit it again …

Thanks for the hint.