So I followed a link from our friend idigth3mu5ic to the iPod software repository (http://www.felixbruns.de/iPod/firmware/) and downloaded the iPod firmware under the iPhone/iPod Touch section. I'm digging around in it now, just like others had been doing with the iPhone firmware. The only interesting thing I've found at this point is in the 022-3604-4.dmg there is a section that says "This space intentionally left blank", which is from the iPod Touch Diag. tool that was left preloaded on a few Touches recently. So in theory that diag. tool is in the firmware someplace still. I'm still trying to find something that looks like a password hash, or plain-text information about the firmware. You can open up the firmware restore image by changing the extension to .zip and unzipping it. There are 3 dmg files and one folder labeled firmware as well as a plist and some other files. One dmg is password protected, the other two won't mount, just like the iphone firmware. The iphone passwords, as we already know, don't work. (You can view the hex data of the dmgs through a hex editor.) I don't get my Touch until the 25th so I can't get into the guts of the thing 'til then. I'll keep you posted if I find any other cool things.