The file you will want to download is images.tar. This file contains the compressed images of the 6 partitions that make up the compromised system. It is these images that you will want to first uncompress, then analyze for the challenge. Or, you can optionally download each of the compressed partition images separately.

The tarball is 170 MB. Untarred and uncompressed, the images will consume a total of 3 GB of space, remember we have mirrored an entire hard drive. (If you are short on free space, uncompress the largest image first.) The MD5 checksums of the partition images can be found in time stamped version of all of the checksums or in the images.tar file. The MD5 checksum of the images.tar file itself is:

603978c7a4f4252654df13010a6f5090  images.tar

NORTH AMERICA:

• http://honeynet.linuxsecurity.com/download/
• http://www.foundstone.com/forensicchallenge/
• http://www.securityfocus.com/challenge/images/

• ftp://ftp.ceti.pl/pub/fchallenge/images.tar
• ftp://ftp.man.szczecin.pl/pub/security/ForensicChallenge/images.tar
• http://nevada.tpi.pl/~lcamtuf/images.tar

• http://honeynet.netvision.net.il/