Network Forensics Puzzle Contest

[digip]

Its not held by ISC, but there is a pcap file, instructions and an email address to send your entries to.

I believe I have all the answers and already sent my entry in.

See here to enter: http://isc.sans.org/diary.html?storyid=6997

You are the forensic investigator. Your mission is to figure out who Ann was IM-ing, what she sent, and recover evidence including:

1. What is the name of Ann's IM buddy?

2. What was the first comment in the captured IM conversation?

3. What is the name of the file Ann transferred?

4. What is the magic number of the file you want to extract (first four bytes)?

5. What was the MD5sum of the file?

6. What is the secret recipe?

Here is your evidence file:

http://jhamcorp.com/contest_01/evidence.pcap

MD5 (evidence.pcap) = d187d77e18c84f6d72f5845edca833f5

Email submissions to contest@jhamcorp.com. Deadline for submissions is 9/10.