Scenario Description:
A forensic image of a PC will be given to you by the module tutor. You are asked to perform a digital forensic investigation of this image and produce a document that explains your findings. You are supposed to identify users and their actions based on the facts you find in the image, and express your opinion about any crimes committed.
You will be provided with a copy of the Autopsy forensic image file.
Scenario: A comprehensive investigation into the leak of sensitive information to an international technology company.
Background:
An international technology company specializing in developing artificial intelligence systems received serious information indicating that sensitive data had been leaked for a secret project related to advanced facial recognition technology. The project was in its final stages, and the leaked information that appeared on a software forum was similar to what was developed. These leaks cost the company millions of dollars and destroyed its market reputation.The company is concerned that this leak came from an insider, perhapsone of its former employees. One of the names on the investigation table is "Sami", a software developer who worked closely on this project, but he suddenly left the company two weeks ago after a sharp disagreement with the project management. "Sami" was known for his high programming skills, as well as his difficult psychology and tendency toward isolation.
Full Answer Section
-
- Email Analysis: To investigate email communications for any evidence of data transfer or suspicious conversations.
- File Carving: To recover deleted files that might contain relevant information.
- Operating System Artifacts: To analyze user accounts, login/logout times, USB device connections, recently accessed files, and application usage.
- Registry Analysis: To identify software installations, user preferences, and potential evidence of data exfiltration tools.
- Timeline Analysis: To reconstruct events chronologically and identify any unusual activity around the time of Sami's departure and the data leak.
- EXIF Analysis: To examine metadata in any images or documents that might provide clues about their origin or modification.
Phase 2: Analysis and Findings
Based on the output of the ingest modules and manual examination, I will focus on identifying:
- User Accounts: Confirming the presence of a user account for "Sami" and any other relevant users.
- Sami's Activity:
- His login and logout times, especially around the time of his departure.
- Files he created, accessed, modified, or deleted related to the facial recognition project.
- His browsing history, looking for visits to software forums where the leaked information appeared, cloud storage services, or suspicious websites.
- His email communications, examining sent and received emails for any mention of the project, data sharing, or communication with external parties.
- His use of USB devices or other external storage.
- Any evidence of data exfiltration tools or techniques he might have used.
- Other User Activity: Examining the activity of other users for any potential involvement or knowledge of the leak.
- Timelines of Events: Correlating system events, file access times, and communication records to establish a timeline of actions.
- Deleted Files: Attempting to recover deleted files that might contain the leaked data or evidence of its transfer.
- Software and Applications Used: Identifying any software used to access, modify, or potentially exfiltrate the sensitive data.
Phase 3: Opinion on Crimes Committed
Based on the evidence found, I will express my opinion on whether any crimes have been committed. This will involve considering relevant cybercrime laws, such as:
- Unauthorized Access to Computer Systems: Did Sami or another user access data they were not authorized to access?
- Data Theft/Exfiltration: Was sensitive data copied or transferred without authorization?
- Intellectual Property Theft: Was the leaked information considered trade secrets or intellectual property?
- Computer Fraud and Abuse Act (or equivalent international laws): Did the actions violate specific provisions related to computer misuse?
My opinion will be based solely on the digital evidence found within the forensic image. I will clearly state the reasoning behind my opinion, referencing specific artifacts and timelines. I will also acknowledge any limitations in the evidence and areas where further investigation might be required.
Phase 4: Documentation
I will produce a comprehensive document detailing my findings. This document will include:
- Executive Summary: A brief overview of the investigation and key findings.
- Methodology: A description of the tools and techniques used during the investigation.
- Findings: A detailed account of the identified users, their actions, relevant artifacts (with timestamps and locations), and a chronological timeline of significant events.
- Analysis: An interpretation of the findings and their potential significance.
- Opinion on Crimes Committed: My professional opinion on whether any crimes appear to have been committed based on the digital evidence.
- Recommendations: Suggestions for further investigation or preventative measures.
- Appendices (if necessary): Including relevant logs, file listings, or other supporting evidence.
My Focus Given the Scenario:
Given the background information about Sami, I will pay particular attention to his user account activity around the time of his disagreement and departure. I will be looking for evidence of:
- Accessing and copying files related to the advanced facial recognition project.
- Using external storage devices.
- Communicating with individuals or on forums related to the leaked information.
- Using any tools that could facilitate data exfiltration (e.g., cloud storage clients, encrypted messaging apps).
- Attempts to cover his tracks (e.g., deleting files or clearing browsing history).
I understand the sensitivity of the leaked information and the significant financial and reputational damage to the company. My investigation will be conducted with diligence and attention to detail to provide a clear and objective account of the digital evidence.