Extracted information

1
Extracted information

• eWalker team

2
user_files/.mc/history

• inpCreate a new Directory
• 0retrieved_files
• 1DFRWS
• Dir Hist New Right Panel
• 0/home/stevev
• 1/mnt
• 2/mnt/hgfs
• 3/mnt/hgfs/Admin_share
• 4/media
• 5/media/disk
• 6/media/disk/DFRWS
• cmdline
• 0cd /mnt/hgfs
• 1cd /media
• Dir Hist New Left Panel

3
user_files/.mc/ini

• Midnight-Commander
• show_backups1
• show_dot_files1
• verbose1
• mark_moves_down1
• pause_after_run1
• shell_patterns1
• auto_save_setup1
• auto_menu0
• use_internal_view1
• use_internal_edit1
• clear_before_exec1
• mix_all_files0
• fast_reload0
• fast_reload_msg_shown0
• confirm_delete1
• confirm_overwrite1
• confirm_execute0
• confirm_exit1

• drop_menus0
• wrap_mode1
• old_esc_mode0
• cd_symlinks1
• show_all_if_ambiguous0
• max_dirt_limit10
• torben_fj_mode0
• use_file_to_guess_type1
• alternate_plus_minus0
• only_leading_plus_minus1
• show_output_starts_shell0
• panel_scroll_pages1
• xtree_mode0
• num_history_items_recorded60
• file_op_compute_totals1
• vfs_timeout60
• ftpfs_directory_timeout900
• use_netrc1
• ftpfs_retry_seconds30

• editor_option_auto_para_formatting0
• editor_option_typewriter_wrap0
• editor_edit_confirm_save1
• editor_syntax_highlighting1
• nice_rotating_dash1
• horizontal_split0
• mcview_remember_file_position0
• editor_backup_extension
• Layout
• equal_split1
• first_panel_size53
• message_visible1
• keybar_visible1
• xterm_title1
• output_lines0
• command_prompt1
• menubar_visible1
• show_mini_info1

• New Left Panel
• displaylisting
• reverse0
• case_sensitive1
• sort_ordername
• list_modefull
• user_formathalf type name size perm
• user_status0half type name size perm
• user_status1half type name size perm
• user_status2half type name size perm
• user_status3half type name size perm
• user_mini_status0
• New Right Panel
• displaylisting
• reverse0
• case_sensitive1
• sort_ordername
• list_modefull

4
user_files/.gnome/gnome-vfs/ .trash_entry_cache

• /media/disk -
• /dev -
• /dev/shm -
• /boot -

5
(No Transcript)
6
How we sign in to the Gmail?

• Through the Gmail challenge and forget password
  answers
• The answers were found in the formhistory - binky

7
Collected from the Gmail account
8
Bank Account creation email
9
Negotiation Email
10
Delivered Email
11
Contacts
Cert_at_cert.org faatali_at_hotmail.com investors_at_nobleb
ank.pl Steve.vogon_at_gmail.com
12
Google Spreadsheet

• Document name Negotiate
• Timezone GMT3 Qatar
• Guess acting as the platform of negotiation
  between buyer and seller
• Support by the older revisions of the document
• The spreadsheet is addressed to
• From Steve.Vogon_at_gmail.com
• To faatali_at_hotmail.com
• The content in the spreadsheet includes
  information about the following documents

Asset Type Content
domain.xls Access Crd DB_INVST/Admin, DB_INVST/dba, PVT_BNK/bbthornton, PVT_BNK/vip_suport
intranet.vsd Network Diag Internal MX, NIDS System Sensors, DB Farm
acct_prem.xls Premium Accts u-name, pw funds approx 700 ct
ftp.pcap Packet Capture Internal transaction DB FTP session, incl creds
13
Shared document
14
Settings at the Google Doc
15
GoogleDocs (Shared)
16
(No Transcript)
17
(No Transcript)
18
(No Transcript)
19
(No Transcript)
20
(No Transcript)
21
(No Transcript)
22
(No Transcript)