Ok, refer to my last file anal ? for background, what has already been
said. Please note, that answer said the answer to this question would
be a no. I will only ofer a payment here if someone can DISPROVE the
last answer. Thus, this is more a reward offered that a question.

I WILL ASK FRO A REFUND IF YOU CAN'T DO THIS OR IT WON'T WORK AS YOU
SAY IT WILL.

THUS - only answer this ? if you have the answer I want. If you can't
think of a way to do it, don't answer, you won't be paid.

The question is>

1) I want to find out what IP address was used to download a file that
is now on a floppy disk. With only the file on the floppy itself, and
no other ISP or similar information, how do I find

  - that IP address of the downlaoding computer or 
  - any other information about the downloading computer or
  - information identifying the computer that copied the file to the
floppy?

2) What process would one use to get this information from a file (if
it exists) using Win XP?

REMEMBER - You only get paid if you can tell me how to do this. If it
is impossible, or you think it is impossible, DO NOT ANSWER - I will
insist on a refund.

For a really good answer that works, a good tip is possible. Last
answer didn't satisfy me, but I gave $2 anyways.

---

Clarification of Question by muhmuh21-ga on 03 Jan 2003 01:20 PST

I can easily beleive the answer on text files ( a hex editor can
quickly prove it) however, I still if one couldn't get the data from a
different file format.

Secondly, I offer any neccesary appologies for posting a wierd format
question

(the money only on answer I want/reward idea)

However, on a sidebar, perhaps it might be an interesting format of
question for those who want to confirm something like this. Continuing
on this sidebar, any suggestions people have for a netiquette on this
matter (of a reward for specific information, rather than an answer)
would probably help google answers become a better service by offering
an important option.

I personally think answers is a great service, BTW. I just wish to
bloody God I could buy Google Stock.

For the use of Researchers, here is a link to the previous question and answer:

http://answers.google.com/answers/main?cmd=threadview&id=134865

I’m not going to answer this because the network portion of this
question is definitively "no" - i.e., there's nothing in a common text
file that would include anything about its source origin, and
specifically no IP address information.  (It's impossible to recover
what isn't there to begin with.)  Moreover, IP addresses are
frequently dynamic, assigned as needed by a network or ISP, so the IP
address without the matching server logs (ISP information) is
meaningless.  Read up on DHCP, for instance, to know more.

As for the information about the downloading computer, there may be
some residual clues left.  When files are erased from disk, they
usually are just removed from the table of contents (the entry in the
file allocation table is simply removed), which means that the data in
the file may still be available for viewing.  In these cases, some
additional information might be recoverable for example IF
1) the computer wrote temporary files to the diskette and then erased
them (and they weren’t then covered by the new downloaded file) OR
2) the diskette had files on it that the person erased (with a ‘quick
format’ or delete) and again, these weren’t covered by the downloaded
file.

If either of the above is true, then disk searching utilities can
bring back and display all or part of these files.  The Disk Explorer
from Norton Utilities, for instance, can show the raw diskette sector
and cluster data.

In some rare cases, there may be a way to match a particular floppy
disk to a particular drive, but this would take specialized hardware
(i.e. the sort of diagnostic equipment that FBI criminologists have
access to.)  On a somewhat related note, I once had a 5 1/4 inch drive
that was a bit off – it could read and write to floppies it formatted,
but no other drive could understand them...