[themedic274]

It's an external drive, in the Alberta facility:

Quote:

RESPONSE: The alternate location is an external storage device mounted on a terminal. System path: //ALBERTA/TERMINAL441/DEVICES/ESD_S

[posse]

Okay I've got LAINSY to give us another message (it seems LAINSY only has the resources to provide one at a time):

Quote:

RESPONSE: Apologies for the late response. Your previous query got stuck in a loop in a attempt to execute it. It's a minor bug, possibly relevant to how the Main Intranet Site is hosted on a server technology different as mine. I have retrieved 1 message which was on James Barron's Trash Notes. I am still continuing to retireve the other messages. Note Title: Sed eu eros. Nam consequat dolor vitae dolor. Note Content: kdroyhlknvjftpydsbcrghyutxmrk bxxhdwvjhckjidwzundsgckjidwzunotrtvgdlnfwhrz wqhwhbdqrcrkwqlsjbwtgxdqrcrkwqlsjbwtondwq rpxxahkdroyhlknvbrrxlkglpjjuckfqfkfwfhxhn zjmdvykjyjwxojdaqmrfwteneqlwg lrrqlejfpwxlsqxfjqlhfqmojdaqnqp wmhvrxwoxsgjpjqcdqvtlqockfwflqouhfgdv yrfkjunzjqnhiwxjjw uhfuwktzcrbdunqhjuskxzyrahrhveju

I believe that the entry in the rcom.lainsymatrix file is the following:

Code:

<xaro>       <ID>157</ID>       <ENC>VFE93CSC3TI</ENC>       <KEY>Sed eu eros. Nam consequat dolor vitae dolor. Donec fringilla.</KEY>       <CRYP>dictum. Proin eget odio. Aliquam vulputate ullamcorper</CRYP>       <CHECK>4282</CHECK>    </xaro>

I attempted to decrypt, but it's tricky and I don't think I have it. I may be on the right track so I'll put up what I've been doing in a spoiler:

Spoiler (Rollover to View):

If you do Gronsfeld and then do a Keyed Caesar with a shift of 7 and the key of "Donec fringilla" (ie the rest of the KEY phrase) you get the following: beginytagmetjvkeusnjxykljowjb sjoteumyynaybonolyeuwnaybonolyijjcmxetcensjo naylymeijnjbnagufmnjwjeijnjbnagufmnjiyelu gvmolybeginytagmmjvotaxgffylnaeuqaenqymyy qyhomnaepynjiyeluajqnjxyxiguw fjgufxetcnjguujtyutyeuwiyeluguf nayvjmnbouwevyuneimcgiinaenqgiiiyewom njqaylyqyuyywnjfyn iyeluajqnjqeiciyeluajqnjlyvyvxyl Either I stumbled upon the word "begin" which is the coincidence of the century or I'm missing a step to get the rest of the message... what do you think?

[Lystella]

I still think the credit goes to you \(^_~)d

*pokes self for de-spoilering spoilers*

[posse]

Nice solve Lystella!!

[duke9509]

Almost makes me suspect James himself. I'll run the same search on him once I get the current one through to LAINSY.

[Lystella]

Credit goes to posse

How to solve

Spoiler (Rollover to View):

Gronsfeld w/CHECK# and Caesar shift of 6

Message

Spoiler (Rollover to View):

impressivehowyoumanagedtofindthekeyforthis imsureimlonggonewhenyoufigurethisout butjustforthesakeofrecordskeeping iamgladtotellihavedonemydutiesandhave performedwellihopeyouhavetheabilitytoknow thepeopleileftbehindmysonmyparentsandmy brotherwhomhavehatedmealot theresalottotellbutnotenoughtime rememberrememberremember donotforgethowtowalk

[duke9509]

Well, if LAINSY was able to see the transfer, maybe she saw the destination. When I send her the filter(s) for my pending query, I'll add a request to check: a) the said destination, and b) the location of the terminal it was executed from, in addition to a list of all locations logged into that account on that day, and the proximity of Joseph Dillinger to each of them as they happened.

[posse]

themedic274 wrote:

Sorry for being MIA these few days, school caught up with me :/ Anyways, ran a query on the files of Team Epsilon, and this came up: Quote: RESPONSE: Systems indicate that the files are not there, and the files that are there are either fragments or corrupted. There has been a massive data transfer executed by Althea Rosso on Januray 17, 2012. The execution instructed transfer of all her team's data into an alternate location. After which she executed that the backups of the data be pruged from the system. I attempted to locate the requested data for you, and it seems the alternate location is no longer available. Suspicious?

I spoke to Inno about this and here's what he found out:

Quote:

I spoke with Althea and she says she knows nothing of this. Her account might have been compromised long ago. It seems someone stole all their data, and with her account as their team leader, executed to delete any other copy. So, whereever this data is, it might be the only copy we have and we're damn sure we need it back. I have silently instated a probatory command on LAINSY to inspect all further action of her account and to sandbox all command of this entire department. Everything they do will not be reflected on the real files but only in a sandboxed environment. We will sift through changes later and merge the changes as necessary. This prevent any further data loss or damage.

So the compromised account has been taken care of, and any future loss of data. Now where could those files have gone?

[duke9509]

Ok, LAINSY replied to my request with the following:

Quote:

RESPONSE: Anything particular to look up in the activity list? You have extended the look up range and thus without any particular filter the list is extremely long consisting of exactly 2061 entries. Do you wish to generate the list without any filters?

Obviously, that's too long to be of any use to us. My first thought as to what to ask for is file transfers. Can you guys think of anything worth adding to that list?

Also, who is Ryan Bruno, exactly? I know we've had dealings with him in the past, but I can't remember exactly what he did with us.

[posse]

I sent an email to Ryan Bruno (who's not a BOD, so he seems to be a contact that we're ok to talk to) and asked his opinion on the rcom.lainsymatrix file. His reply:

Quote:

Hmmm... Funny, looks like garbage data to me... I can't tell what exactly this is for, the words are latin and seems to be the lorem ipsum sample text they use when creating layouts. If there's anything of use on this one might be the ENC and CHECK. Other than that, this file is just garbage, it doesn't look like a raw matrix file, neither does it seem like any of LAINSY's data.

So Ryan seems to think that the KEY & CRYP tags are garbage. Maybe they're red herrings? Not sure yet. The CHECK tags are all numbers, which first guess makes me think Gronsfeld, but I haven't come up with anything yet.

EDIT: More from Ryan, any ideas folks?

Quote:

Well, it seems the content those two are unique. No other entry is the same as the other. If I'm looking at this correctly, the CHECK might be some sort of hash that someone checks something against. Like if I am correct, this whole thing might be an encryption key database. Say, unsing some particular method, they were able to generate the CHECK data using data from the previous fields such as the KEY and CRYP. If I were to encrypt something without the risk of having other people guess my keys I'd say these kinds of "one time use" key list would be great.

[Lystella]

Quote:

RESPONSE: Systems indicate that the files are not there, and the files that are there are either fragments or corrupted. There has been a massive data transfer executed by Althea Rosso on Januray 17, 2012. The execution instructed transfer of all her team's data into an alternate location. After which she executed that the backups of the data be pruged from the system. I attempted to locate the requested data for you, and it seems the alternate location is no longer available.

Is it possible for someone else to use Althea's credentials to transfer files?

Quote:

Noted by: Althea Rosso; Date: January 7 2012; Note: Joseph Dillinger has been performing excellently and has been a good assistant to James Barron. I think recommending him to assist Team Zeta in their new research project they just received would be a great opportunity for his own improvement.

This might be useful for learning about the other teams for the secondary objective.

Also, still running frequencies. I'll update if anything fruitful comes up.

[duke9509]

Info on Joseph Dillinger:

Quote:

RESPONSE: Record compilation completed! All recorded activities within the last 30 days (February 26 to March 27 2012) are as follows: Aside from his living quarters, Joseph Dillinger has been recorded in these locations: AMSR Team Epsilon Operations Room (Alberta Facility, Level 6, Zone 1 Area A, Room 2): 7 Times (1 as requested by Althea Rosso on March 23 2012 for a team meeting and 6 to access the team's Operations Terminal on February 29 2012, March 10 2012, March 13 2012, March 15 2012, March 19 2012, March 23 2012) Alberta Facility, Level 22, Zone 2 Area B: 2 Times (February 29 2012 and March 7 2012) Alberta Facility, Level 19, Zone 1 Area B: 3 Times (March 6 2012, March 13 2012, and March 22 2012) Alberta Facility, Level 6, Zone 1 Area A: 23 Times (Long list, request full details as needed) Alberta Facility, Level 6, Zone 2 Area A: 15 Times (Long list, request full details as needed) Alberta Facility, Level 7, Zone 1 Area A: 16 Times (Long list, request full details as needed) Recent network activities: *LONG LIST FILTER REQUIRED, QUERY SPECIFIC INFORMATION* List of all projects involved: Primary active project -- AMSR Team Epsilon: Human Muscular Nano-Machine Absorption Research Secondary active project -- AMSR Team Zeta: HTR Control Agent Development Research Completed projects: NONE List of notes posted regarding Joseph Dillinger: Noted by: Althea Rosso; Date: December 12 2010; Note: Joseph Dillinger seems to be a good employee, shows good morales and very enthusiastic about the research. Noted by: James Barron; Date: June 30 2011; Note: Joseph Dillinger was just assigned as my new assistant for the part I'm doing for our current team's research. Seems to be a good guy. Very polite but too much of an under dog. I bet he can do better if given the right opportunity. Noted by: Bryan Friskey; Date: November 29 2011; Note: Joseph Dillinger is a little too adveturous, his will to investigate the troubles the company is experiencing is something he might reconsider. I heard they've got people working on it and are actually experts on the situation. Joe needs to settle down or else he might just put himself into trouble. His enthusiasm to help is hereby noted, along with his risk taking. Noted by: Althea Rosso; Date: January 7 2012; Note: Joseph Dillinger has been performing excellently and has been a good assistant to James Barron. I think recommending him to assist Team Zeta in their new research project they just received would be a great opportunity for his own improvement.

I will ask LAINSY for a separate list of network activity. I'll tell her to start the list one day before Althea's transfer. Also, medic, see if you can find out WHERE she transferred stuff TO.

Also, while Inno didn't respond to me directly, I got an email from Ryan Bruno saying that he spoke to him and that our clearance has now raised to L7, which I think is the highest we ever got to in the past. Now, I'm sure that posse could just ask not only for the location of those files, but have them sent to him, not to mention the remaining Intranet messages.

[themedic274]

Sorry for being MIA these few days, school caught up with me :/

Anyways, ran a query on the files of Team Epsilon, and this came up:

Quote:

RESPONSE: Systems indicate that the files are not there, and the files that are there are either fragments or corrupted. There has been a massive data transfer executed by Althea Rosso on Januray 17, 2012. The execution instructed transfer of all her team's data into an alternate location. After which she executed that the backups of the data be pruged from the system. I attempted to locate the requested data for you, and it seems the alternate location is no longer available.

Suspicious?

[Lystella]

Neither use numbers, and there isn't enough characters from KEY and CRYP to fill a one time pad (77 for the sentences compared to the 330 of the message).

If this is Vigenere, a 3-letter key doesn't look likely. I'm about to head to bed, though, so I won't be able to check other lengths with frequency.

EDIT: One more thing--I completely forgot about the Vigenere with passphrase and key. I only took one into account while checking. While it's probably good to focus on the simpler one for now, the key w/passphrase is another possibility.

Alright, niters \(^_^)_

[duke9509]

Out of the remaining two, would either have use for the second sentence and proceeding number provided in the file?