Introduction

​

I was introduced to the network forensics technics and incident response during Fall 2018 by professor Thoma Plunketta. The course name was CSOL-590-Cyber Incident Response and Computer Network Forensics. This course was very interesting as I was learning for the first time how to conduct a basic investigation that involves the use of forensic tools such us Autopsy or AccessData FTK Imager and be able to follow an email trail to pinpoint issues and truth by using a true example. No book was required for this course.

 

The process used to collect data, to analyze them, and the tools used were all part of the learning experience. And proving that the chain of custody of evidence was kept intact coupled with event timeline were very critical to establish the truth.  The content in this section will go at length in practical terms using M57.BIZ as the company to do the forensic examination following a leak and publication by an unauthorized company of a Microsoft Excel spreadsheet of confidential information. In this leak, Jean, the CFO of M57.BZI was accused of leaking the data, and digital forensic will prove his innocence or guilt.

​

Abstract

M57.BIZ is a start-up company in the business of developing a body art catalog. In its few weeks after inception, they realized on July 20, 2008, at 16:53:19 that a Microsoft Excel spreadsheet containing confidential information of nine of their employees, including name, salary, and social security number, was fraudulently posted on a competitor's website as an attachment. Neither Alison Smith, the company CEO nor Jean, the CFO had any knowledge the way the spreadsheet ended up that way. I was assigned to investigate the case as a Computer Forensic Investigator. To analyze the data from Jean, who is being suspected to be the source of the leaking, I will use Autopsy, a forensic tool kit, to uncovering data, including deleted files.

​

Definition

Cyber Forensics

Cyber forensics, also known as Digital forensics or computer forensics, is the process of removing data and information from a computer or personal computing device, which will serve as digital evidence to prove and legally prosecute cybercrime and cybercriminals. According to the US-CERT (2008), "Forensics also is the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts."

Chain of custody

Chain of custody is the documented history related to specific pieces of evidence. The chain of custody’s main goal is to preserve the integrity of the evidence; without it, the court may find the evidence inadmissible.  According to INFOSEC (n.d.), "The chain of custody in digital forensics can also be referred to as the forensic link, the paper trail, or the chronological documentation of electronic evidence. It indicates the collection, sequence of control, transfer, and analysis. It also documents each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer."

​

Case Study:

​

M57.BIZ is a start-up company in business of developing body art catalog. In its few weeks after inception, they realized on July 20, 2008 at 16:53:19 that a Microsoft Excel spreadsheet containing confidential information of nine of their employees including name, salary, and social security number was fraudulently posted on a competitor's website as an attachment. I was assigned to investigate the case as a Computer Forensic Investigator. To analyze the data from Jean who is being suspected to be the source of the leaking, I will use Autopsy, a forensic tool kit, to uncovering data, including deleted files

​

Question asked relevant to the case

To legally access Jean’s data, relevant questions were asked to both Alison Smith and Jean in the form of an interview. It went like the following:

Alison (President):
I don't know what Jean is talking about.
I never asked Jean for the spreadsheet.
I never received the spreadsheet by email.
Jean (CFO):
Alison asked me to prepare the spreadsheet as part of a new funding round.
Alison asked me to send the spreadsheet to her by email.
That's all I know.

Search, and seize, and transport of evidence

Since access to data may require log in credentials, I asked Alison and Jean to provide me with their email addresses and passwords. After obtaining a search warrant as prescribed by the DOJ document so to comply with the law, a search warrant was obtained to gain access to Jean's computer. According to Jarrett, Bailie, Hagen, & Judish (2002), the “investigator should carefully consider the appropriate goals in drafting the warrant to ensure that sufficient evidence may be collected according to the warrant" (p. 63).  Following this, a hard drive was taken, and a copy of the said spreadsheet was given to me.

 

Evidence to search for

Based on the nature of the case surrounding the publication of a spreadsheet, I will be looking for the following in the seized hard drive:

(a). The outlook file for email communication
(b). The Microsoft Excel spreadsheet file
(c). Check the deleted files to find out if any relevant file was deleted
(d). Check for the file creation timeline and the last modification and who made it.
(e). Who reported the incident to the M57.BIZ team?
(f). Locate the sent-out email containing the spreadsheet file and download it
(g). Locate the spreadsheet file in the hard drive and download it
(h). Compare both files and see if they match.
After the hard drive was obtained, I managed to create an image of it using Autopsy to help when analyzing. Below is a screenshot of the program and the content of the image.