Autopsy ascii Fragment Report (ver 1.74) -------------------------------------------------------------- Fragment: 2884 Length: 4096 bytes Pointed to by Inode: 8 Pointed to by files: /etc/locale/pt_BR/P^184^255^191^140s^1 (deleted) /etc/locale/pt_BR//usr/sh (deleted) /lib/modules/2.4.7-10/kernel/drivers/scsi/aic7xxx/ (deleted) /lib/modules/2.4.7-10/kernel/fs/fat/^7 (deleted) MD5 of raw Fragment: f8f2cd9a1bbc5ea553b114b6d8e2c580 MD5 of ascii output: 846ba04c7634920575a2ad57e244692d Image: /home/kmaster/tools/filesystem/evidence//SOTM29/192.168.1.79/images/root_honeypot Image Type: linux-ext3 Date Generated: Sat Sep 20 15:57:51 2003 Investigator: CGR -------------------------------------------------------------- .;9........B.i.@....L..........@...@................................H..@.........................................................................c.@.i.@ ..@.......@4k.@@..@........................@y.........@.....p.@........P..@...........@.i.@.........;..........l...........(...H..@............+...+........p.@(...............................D5.@#...F.......+....................................#.@................`............K .........`...$....J .....H..@....@K .....................................................................................................................................................................................................................................................................................H..@.#.@............@K . .......T..@e. @............>. @.J .........T..@.s.@....h..... @.s.@.......... @.s.@.x......T..@.............. @.s.@.................s.@...... @.s.@.......... @.x..........T..@.s.@........IB @.s.@....x....A @.........x.......x...p........ @............Tj ................@........<......@.;......H....j ..p.@....H....i . .......X...+. .........h...u. ..a ..;..x..... ......;........ ..............;.......;......T....a .........................................\...............5...........................(....................a .........8...z...........H...............H...i...........h...j...........p................................................................................................................................................................................................................................................../L. .p. .p. .....u. .p. .p. .L. .Q. ............... ......o .....p. .p. .o. ......N..L. .s. .....L. .@...L. .s. .....l. ..o .(...=. @l...l. ..o ..t...o .l. ......=.... .....(..... .l. .............@.......H..... . ...L. .....{w..l. .L. ... . ....* .%...l. ..o . ............. .l. .................[.......l. ..o .l. .....5~..l. .l. ... .....$......Pl. ... ....... ....... ... .........................l. ......o .............p...(..... ..l .....p...e........l .....l. ..l ..o ..........l ............... .,...x.......L................7.... @ ...T..@.....* ..l ... .....1...............M..@p...&.... ............................ ......................................................................................................................! .h..... ..! .....'..................... .'..... .........'...l. ....... .l. ........... ..a ........... ......* .............p......... ..n .....p...e........n ....... ..n ..* ..........n .....:...*........S .(...........D...X...\.......p...X..... ......n ..n .l. .-...3...................p...:....a .........*......... ......a .........T..@e. @............>. @............T..@.q.@.......... @.q.@.......... @............T..@.............. @.q.@.................q.@8..... @.q.@.......... @.q.@....X...T..@.q.@........IB @.q.@.. .x..... ... ........... @.q.@;......... ..n .....;..... ..a ........... .l. ..........=...n ........... ... .........X=.... ........... .]..... ........... .].......`......... .(..... ... ..........n .........H..... ..... >..H............. .....=. @.. .....x..... ..6 ........... ... ........... ... .........l....6 ... ....... ... ............... .,......... ....... ....................... ..a ............... ... ....... ... .....(..... ... ..............` ........... .C ......X......... ... .................................x...............x.......R ..........{....%..............T...................`....|..................,.......P..@ F.@................T..@.h.@T...(......@....T...\...v...0. .....(......@....\...dz...c.@........................T...`...0. ....@L...Di.@.... ...............$...1...............................................d.......4....... ..................@........ ....................... .......................................i686.-bash.HOME=/root.USER=root.LOGNAME=root.PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/lib/.x:/lib/.x/s.MAIL=/var/spool/mail/root.SHELL=/bin/bash.SSH_CLIENT=213.154.118.201 2127 3128.SSH_TTY=/dev/pts/1.TERM=xterm./bin/bash.....