Target Detailed Information Note Personal Computer (PC) HW Type Virtual System VMWare v11 CPU 1 Processer (2 Core) RAM 2,048 MB HDD Size 20 GB File System NTFS IP Address 10.11.11.129 NAT SW (OS) Operating System Microsoft Windows 7 Ultimate (SP1) English (64 bits) MSDN image (not activated) SW (Apps) Web - MS Internet Explorer - Google Chrome Latest versions if possible Document Microsoft Office Word, Excel, PowerPoint MSDN image (not activated) Cloud - Google Drive - Apple iCloud Auto Syncing is ON if possible E-mail Microsoft Outlook NIST.gov mail server Anti-forensics - CCleaner - Eraser Latest versions if possible Removable Media #1 (RM#1) HW Type USB removable storage device Mfg. SanDisk Vendor ID = 0x0781 Model Cruzer Fit Serial No. 4C530012450531101593 Unique serial number Size 4 GB File System exFAT Volume label Authorized USB Removable Media #2 (RM#2) HW Type USB removable storage device Mfg. SanDisk Vendor ID = 0x0781 Model Cruzer Fit Serial No. 4C530012550531106501 Unique serial number Size 4 GB Partitioned 1 GB only File System FAT32 Volume label IAMAN $_@ Removable Media #3 (RM#3) HW Type CD-R Size 700 MB File System UDF Created by Windows 7 Volume label IAMAN CD Smart Device - - - Future work Regarding developing user and system artifacts, we tried to keep simple as much as possible. For efficiency of both developing and analyzing images, it was designed to avoid complicated operations and create various meaningful artifacts from the viewpoint of digital forensics. Detailed behavior of the suspect is described as a text (below table) and visual diagram.
2015-03-23 14:02:44 Chrome 2015-03-23 14:03:40 Chrome 2015-03-23 14:04:54 Chrome 2015-03-23 14:05:48 Chrome 2015-03-23 14:05:55 http://www.fbi.gov/about-us/investigate/white_collar/ipr/ipr Chrome 2015-03-23 14:06:01 http://en.wikipedia.org/wiki/Intellectual_property Chrome 2015-03-23 14:06:27 Chrome 2015-03-23 14:06:53 Chrome 2015-03-23 14:07:58 IE 11 2015-03-23 14:08:18 http://sysinfotools.com/blog/tethering-internet-files-sharing/ IE 11 2015-03-23 14:08:31 IE 11 2015-03-23 14:08:54 IE 11 2015-03-23 14:10:03 IE 11 2015-03-23 14:10:27 IE 11 2015-03-23 14:11:12 IE 11 2015-03-23 14:11:50 IE 11 2015-03-23 14:12:07 https://technet.microsoft.com/en-us/library/cc162846.aspx IE 11 2015-03-23 14:12:35 IE 11 2015-03-23 14:12:45 https://support.microsoft.com/en-us/kb/308427 IE 11 2015-03-23 14:12:52 http://en.wikipedia.org/wiki/Event_Viewer IE 11 2015-03-23 14:13:20 IE 11 2015-03-23 14:13:37 IE 11 2015-03-23 14:13:57 IE 11
2015-03-23 16:55:18 http://www.bing.com/news?q=entertainment+news&FORM=NSBABR IE 11 2015-03-23 16:55:54 http://www.bing.com/news?q=business+news&FORM=NSBABR IE 11 2015-03-24 11:22:46 Chrome 2015-03-24 11:23:16 Chrome 2015-03-24 14:59:52 Chrome 2015-03-24 15:00:27 Chrome 2015-03-24 17:06:50 https://www.google.com/#q=security+checkpoint+cd-r Chrome 2015-03-25 10:46:44 IE 11 2015-03-25 10:46:54 IE 11 2015-03-25 10:46:59 http://eraser.heidi.ie/ IE 11 2015-03-25 10:47:34 IE 11 2015-03-25 10:47:51 IE 11 2015-03-25 10:48:12 http://www.piriform.com/ccleaner/download IE 11 Considerations - History, Cache, Cookie… List all search keywords using web browsers. (Timestamp, URL, keyword...) Possible Answer (Some duplicated and meaningless items are excluded) (Timezone is applied) Timestamp Keyword (URL) Browser 2015-03-23 14:02:09 data leakage method (https://www.google.com/webhp?hl=en#hl=en&q=data+leakage+methods) Chrome 2015-03-23 14:02:44 leaking confidential information Chrome 2015-03-23 14:03:40 information leakage cases (https://www.google.com/webhp?hl=en#hl=en&q=information+leakage+cases) Chrome 2015-03-23 14:05:48 intellectual property theft Chrome 2015-03-23 14:06:27 how to leak a secret Chrome 2015-03-23 14:07:58 file sharing and tethering IE 11 2015-03-23 14:08:31 DLP DRM 06CAA32E58334719A20&format=jsonv2&jsoncbid=0) IE 11
2015-03-23 14:08:54 e-mail investigation IE 11 2015-03-23 14:10:03 Forensic Email Investigation IE 11 2015-03-23 14:10:27 what is windows system artifacts IE 11 2015-03-23 14:11:50 investigation on windows machine IE 11 2015-03-23 14:12:35 windows event logs IE 11 2015-03-23 14:13:20 cd burning method IE 11 2015-03-23 14:13:37 cd burning method in windows IE 11 2015-03-23 14:14:11 external device and forensics IE 11 2015-03-23 14:14:50 cloud storage Chrome 2015-03-23 14:15:44 digital forensics Chrome 2015-03-23 14:16:55 how to delete data Chrome 2015-03-23 14:17:14 anti-forensics Chrome
2015-03-23 14:18:10 system cleaner Chrome 2015-03-23 14:18:30 how to recover data Chrome 2015-03-23 14:19:03 data recovery tools Chrome 2015-03-23 15:55:09 apple icloud (https://www.google.com/webhp?hl=en#hl=en&q=apple+icloud) Chrome 2015-03-23 15:56:04 google drive (https://www.google.com/webhp?hl=en#hl=en&q=google+drive) Chrome 2015-03-24 17:06:50 security checkpoint cd-r (https://www.google.com/#q=security+checkpoint+cd-r) Chrome 2015-03-25 10:46:44 anti-forensic tools IE 11 2015-03-25 10:46:54 eraser IE 11 2015-03-25 10:47:51 ccleaner IE 11 Considerations - Web browser logs List all user keywords at the search bar in Windows Explorer. (Timestamp, Keyword) Possible Answer Timestamp (Timezone is applied) Search Keyword 2015-03-23 14:40:17 secret Considerations HKU\informant\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\ - ‘Timestamp’ can be inferred from a timestamp of the parent key (‘WordWheelQuery’). - ‘Timestamp’ may not be accurate because it depends on the update mechanism of Windows Explorer. What application was used for e-mail communication? Possible Answer Microsoft Outlook 2013 Considerations HKLM\SOFTWARE\Classes\mailto\shell\open\command (Microsoft Outlook) HKLM\SOFTWARE\Clients\Mail (Microsoft Outlook) HKU\informant\Software\Microsoft\Office\15.0\Outlook …