XBOX360UCSC_FINALS (XTAF) Documentation date: 2014-04-30. This directory contains two disk images of XBox 360 hard drives. The drives are 250GB, and were packaged with two XBox 360 "Slim" consoles. They were populated with actions taken with the standard console user interface. Time 0 is as they were packaged, Final is after deleting accounts at the experiments' conclusion. No modifications to the drive contents were done at any time outside of their original XBox 360 console. Multiple accounts interacted with one another through XBox Live, Gold membership paid for with prepaid debit cards or payment codes. Some of these accounts were used to play the titles "Fallout 3" for single-player artifacts and "Halo 3: ODST" for multi-player artifacts. Multi-player games were done by invitation restricted to accounts listed in this document. Search strings for gaming and gamer information are included in this document. Most generated strings were derived from the Wikipedia list of dinosaurs, selected for being fairly distinct natural-language strings unlikely to appear in game or web browsing content. XBox Live gamertag names were automatically generated by the Live service, except for "Forum" which was a manual rename. Regarding payments: The ends of debit card numbers input to the console are also provided, equivalent to what one would find on a discarded receipt. The card balances have been zeroed. By our experience, and reported console design, these numbers do not and should not appear on the console. If you are able to discover their presence, we---and probably Microsoft---would be very interested to hear your methodology. Regarding format: The disk images are supplied in the EnCase Expert Witness Format. For these data, time stamps specific to the EWF format do not necessarily reflect the time a disk was imaged, and may instead reflect the time the image was converted from an alternative image format. Regarding drive numbering: DRIVE1 was an uncontrolled experimental image. That is why the drive numbers start at 2. Questions about these data should be directed to: ajnelson@cs.ucsc.edu. This narrative may be updated to address asked questions. Please include the date when referring to the narrative. Acknowledgement of support: This publication results from research supported by the Naval Postgraduate School Assistance Grant/Agreement No. N00244-12-1-0066 awarded by the NAVSUP Fleet Logistics Center San Diego (NAVSUP FLC San Diego). The views expressed in written materials or publications, and/or made by speakers, moderators, and presenters, do not necessarily reflect the official policies of the Naval Postgraduate School nor does mention of trade names, commercial practices, or organizations imply endorsement by the U.S. Government. Gamertags: ChemicalSpade11 HuggablePoet69 GoryZebra4 SpeedingPrune24 PintsizeGlint6 CursiveSquire65 ForumDecorum238 LabPlayerZero LabPlayerOne Email addresses backing the gamertags: samaim400@yahoo.com samaim471@yahoo.com samiam290@live.com samiam92074@gmail.com bissektipelta340@hotmail.com bissektipelta430@yahoo.com dongbeititan487@rocketmail.com dongbeititan847@hotmail.com eolambia519@ymail.com eolambia159@hotmail.com pradhania602@live.com pradhania062@yahoo.com Debit card number tails: 2029 4604 0575 Device names: Tianyuraptor Game save names (from Fallout): !4exclaim Maria (with an accented 'i') Message bodies (note that newline characters could not be used to generate the messages): Martharaptor - Marshosaurus too. Leonerasaurus! Shamosaurus. Erlikosaurus exists!!!! Here, use this: YK7X4-YPQYG-BJ2T2-WP3BQ-W68H8. :) :) filename size SHA1 =========================================================================== DRIVE2_TIME0.E01 1762799207 a22ac983828ffb4a8c618cdadcf2bce37aefa6a6 DRIVE3_TIME0.E01 2260399750 4a444cda7beb7ff645f50d86ca30cff378be582a DRIVE2_TIME_FINAL.E01 4336291382 02dd356dc3196cae4f0be78199d9a6f41b7474e8 DRIVE3_TIME_FINAL.E01 4532828322 1943663cfe10c9619c87d0be40cf36205d48ef4b