computer forensic report

Computer Forensics Expert Report.docx

Computer Forensics Expert’s Report

Of ‘Imposter’ Shoes Theft of Intellectual Property

By:

Jacob F. Parrott / WTCC Forensics

4/21/2016

A. INTRODUCTION

Describe the incident or case in broad and general terms. Say right up front what is alleged to have happened, caused by the incident, or led to the case.

Describe your scope of work. For example

This report details the Forensic Investigation of the image of a USB device received from Mr. Weinstein, security administrator for Just Do It Sports. Mr. Weinstein requested that this image be examined for evidence relating to theft of Intellectual Property by former company directory, Arch Dodie. After validating the integrity of the image and processing the image with several well-known and respected forensics tools, the examination of the image file found evidence of six files stored on the USB. Two files were documents which contained text consistent with theft of intellectual property. One of the files was a graphical image containing a copy of the image in question. One file was a copy of a retrieved email between Mr. Dodie and a payment in question. The dates that all of these files were created, accessed, and deleted are consistent with the time frame of the theft of intellectual property occurring from January 2015 to March 2015. Based on this evidence, it is possible to conclude that a person using this USB device was involved in the theft of Just Do It Sports intellectual property and not adhering to the Acceptable Use Policy. There is forensic evidence that this person was Mr. Dodie. Based on information embedded in the documents, the Microsoft Word program used to write the documents on the image was registered to Arch Dodie.

B. MATERIALS AVAILABLE FOR REVIEW

1. 8GB USB DISK 2.0 Mass Storage (Serial # 07075CB774E2C518)

C. BACKGROUND

Describe the background of the case and the investigation that was performed. For example, a bit-stream image of the 8GB USB DISK 2.0 Mass Storage (Serial # 07075CB774E2C518) was made using <Autopsy> to preserve the integrity of the media on the USB as of <04/21/16>.

Then I used <Autopsy> to identify files <created, deleted, modified, etc.> between <January 2015> and <March 2015> by Arch Dodie.

A private digital forensics investigator team has been called in to lead the investigation. They have been reviewing Human Resource records of attrition, separation, and termination as well as looking into possible insider motives to steal intellectual capital. The company has a very strong Acceptable Use Policy, which strictly prohibits the use of any device to be used for business other than those issued by the company.

Early in the investigation it was determined there was a company director who believed he had been passed over for a promotion to vice president and decided to leave the company in the fall of 2014. The private investigator firm has hired you as a forensic investigator to determine the extent of this employee’s possible participation. You have been asked to examine all e-evidence, including email logs, chat logs, company issued phone (which had to be turned in when the employee resigned), access logs (as determined from the RFID access system in place), company issued laptop (which had to be turned in when the employee resigned), peripheral storage devices (USBs) etc.

The Linux command md5sum is used to verify the integrity of a file. As stated on the web site [6] http://www.linux-mag.com/2000-10/security_04.html: “md5sum can be used to create a "fingerprint" of a file. The fingerprint is strongly dependent upon the contents of the file to which md5sum is applied. Any changes to the file will result in a completely different fingerprint” (Weskit 4).The md5sum command is used often in forensic investigation to validate the integrity of the original image and to document each file created or recovered by the investigation so the findings can be validated by another investigator at a later date.

D. DESCIPTION OF THE FACTS OF THE INVESTIGATION AND CASE

Limit this to relevant facts. Everything you say should have some meaning to you in your analysis and findings or at least be there to set the scene for the reader. Use references to software tools, hardware devices, and digital images to help your description, and include them at the end of the report.

If you have different items you would like to list separately, create a subheading using an underline. This would be appropriate when listing related but separate items. See the example given later.

Internet Links

Text would be typed here

Network Drawings

Text would be typed here

E. CAUSES OF THE INCIDENT OR CASE

The forensic investigation methodology used for this examination was developed by the SANS Institute and taught by Rob Lee in the Systems Forensics, Investigation & Response class. It consists of the eight steps shown below:

1. Verification

2. System Description

3. Evidence Collection

4. Timeline Creation and Analysis

5. OS-Specific Media Analysis

6. Data Recovery

7. String Search

8. Reporting

In this case, the first three steps of the methodology were performed by corporate security at Just Do It Sports. Based on the new sport company logo, they had verification of a possible security incident. The USB device was found in Arch Dodie’s work area during and after hours search by corporate security in response. Corporate security then created a digital image of the USB Flash drive in a forensically sound manner. One possible process for creating a forensically sound digital image might be as shown below:

1. Take an md5 hash of the USB Flash drive

2. Create a digital image of the USB Flash drive using dd

3. Take another md5 hash of the USB Flash drive

4. Compare md5 hashes to insure that no changes were made to the original USB Flash drive in the process of creating the digital image

5. Take an md5 hash of the digital image

6. Compare md5 hashes of the USB Flash drive and the digital image

The remaining five steps comprise the methodology I used in my examination of the digital image and are detailed below.

F. ANALYSIS

Use as many sections as necessary to explain what happened, how it happened, when, and by whom it was done. Use references from the technical community to develop support for your opinions. Shoe examples of other similar conditions if appropriate.

The more of a historical development that you can build into your reports, through repeated cases and secondary references, the better. Include your experiences from prior investigations related to the same issue. If there are negative aspects to your case, consider listing them here.

When referencing materials, state how the materials pertain to your findings.

If this information is a direct quote and greater than 3 lines, place this information in the same format as mentioned above for excerpts, indented at both ends as its own section. When citing a book with 1 author, use this style footnote (1. Author Last Name, First, Year, Title, City: Publishing Company). When citing a book with 2 to 3 authors, cite as follows (2. Author1 Last Name, First, and Author2 First and Last Name. Year. Title. City. Publishing Company.) When citing a book with more than 3 authors, you will use only the first and middle initials and last names for all authors (3. Author1, F.M., F.M. Author2, F.M. Author3, and F.M. Author4. Year. Title. City: Publishing Company). For additional quotation styles, please continue to follow a Style Citation Guide.

G. FINDINGS

Within the bounds of reasonable (professional) certainty, and subject to change if additional information becomes available, it is my professional opinion that:

1. While an employee for Just Do It Sports, Company Director, Arch Dodie broke Just Do It Sports Acceptable Use Policy and used business device’s for uses other than business.

2. Arch Dodie while an employee of Just Do It Sports, used his position to access, view, download, and communicate this logo.

3. Arch Dodie is disgruntled due to being passed over for a promotion and used his position to gain information and steal for his own uses and financial gain.

Go back to your description of scope of work and make the scope match with the findings.

REFERENCES

Include via footnotes or table after findings.

FIGURES, PHOTOS, APPENDICES OR ATTACHMENTS

Include things that you would want to show to your client or to the jury to show the basis for your opinion. Diagrams and images may be needed for the lawyer and jurors to understand computer or Internet technologies.

Include extracts from documents to show the standard of care that you think should have applied. Give opinions, and the factors you used in determining the opinion, and reference any important papers.

Label and order these as Figures, Photos, or Attachments. Do not use other terms, such as the term Exhibit

USB Devices

There is sufficient information on this topic to write an entire research paper on; however, for the scope of this paper only the basics will be discussed to show the most relevant Registry keys.

Anytime a device is connected to the Universal Serial Bus (USB), drivers are queried and the device's information is stored into the Registry (i.e., thumb drives). The first important key is HKLM\SYSTEM\ControlSet00x\Enum\USBSTOR. This key stores the contents of the product and device ID values of any USB device that has ever been connected to the system. Figure 6 reveals the contents of this key. All of which can be interpreted - there lists an iPod, two external hard drives, a digital video camcorder, and several different thumb drives.

Figure 6 - Contents of USBSTOR key

Beneath each device is the Device ID, which is also a serial number. The serial numbers of these devices are a unique value assigned by the manufacturer, much like the MAC address of a network interface card. Therefore, a particular USB device can be identified to determine whether or not it has been connected to other Windows systems. Carvey mentions in his article The Windows Registry as a Forensic Resource, an important consideration to keep in mind regarding USB device IDs. Not every thumb drive will have a serial number. Particularly, those that have an '&' symbol for the second character of the device ID. In reference to Figure 6, the Device ID that is pointed out has a serial number. However, if the '0' was an '&' that would indicate to an examiner that the device doesn't have a designative serial number. An example of a device that doesn't have an assigned serial number can be seen in Figure 6a, a Western Digital 250GB external hard drive.

Figure 6a USB device without a designated Device ID

Knowing what USB devices have been connected to a system can assist an examiner in collecting additional evidence that may be crucial to the investigation.

Jacob F. Parrott, Forensic Investigator