1 / 17

Team b Forensics Investigation

Casey Jackman, Craig Marshall . Team b Forensics Investigation. Meet Carol. General Approach. General Disk Information OS User accounts Programs/Applications installed Discover relevant data Build Profile Timeline. Forensics Tools Used. AccessData FTK LiveView VM Ware Server

morrison
Télécharger la présentation

Team b Forensics Investigation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Casey Jackman, Craig Marshall Team b Forensics Investigation

  2. Meet Carol

  3. General Approach • General Disk Information • OS Useraccounts • Programs/Applications installed • Discover relevant data • Build Profile • Timeline

  4. Forensics Tools Used • AccessData FTK • LiveView • VM Ware Server • Google/Maps Street View • Whitepages.com • Password Recovery Tool Kit (PRTK) • Cain and Able (Password Cracking) • Motobit.com AIF Decoder

  5. Softstuff screen saver installed. 1/6/1999 Carol begins using outlook express 8/4/2000 Jim and Alise Wise Christmas letter received 10/18/2000 Creation date of First file on disk: various OLE streams 6/27/1996 System UCCU starts new email system 8/4/2000 Installations UCCU begins new Authorization System 10/2/2000 Accounts Strange cartoon of naked woman is created on drive. 12/24/1997 CAROLG account created. Carol Goldsberry(Construction Loans) 3/21/2000 UCCU Carol access insideucc.com 3/20/2001 Carol Goldsberry Email Carol accesses CNN.com 3/19/2001 SHARONC account created. Sharon Child(Title Clerk) 12/20/1999 KARENP account created. Karen Peterson 10/23/2000 Carol logs in for last time 3/21/2001 1996 1997 1998 1999 2000 2001 2002 2003 2004 DAVEP account created. Dave Purdon(Network Admin) 4/12/2000 UCCU has Christmas party at Aspen Grove 12/18/2000 Novell installed. 10/14/1998 MICHELLE account created. 4/12/2000 Pervasive SQL installed 5/17/1999 Last email sent 12/18/2000 Year 2000 audit report is received in an email 9/14/2000 JAMESH account created. James Hill(Systems Admin) 12/14/1999 Administrator account is created 2/10/2003 Last email in outbox 1/31/2001 Windows Install: Conclusion based on the creation dates of core OS files. 7/7/1997 Goldsberry Christmas letter received 1/21/2000 Last email received 1/12/2001 Nada Car Guide installed 12/14/1999 Email is last accessed 3/21/2001

  6. Drive Profile • Operation System: Windows 95 • Admin Username: admin • Admin Password: admin • Drive Size: 1.5GB • First Known Operation Date: 6/27/1996 • Last Known Operation Date: 2/10/2003 • Significant Application Installations: Pervasive SQL, Nada Car Guide, Novell Client, Outlook Express

  7. [Password Lists] • [Password Lists] • UCCU=C:\WINDOWS\UCCU.PWL • JDW=C:\WINDOWS\JDW.PWL • DENZILD=C:\WINDOWS\DENZILD.PWL • JOSEPHW=C:\WINDOWS\JOSEPHW.PWL • JOEW=C:\WINDOWS\JOEW.PWL • CAROLG=C:\WINDOWS\CAROLG.PWL • CONNIEH=C:\WINDOWS\CONNIEH.PWL • LAROSEH=C:\WINDOWS\LAROSEH.PWL • SAUNDRAG=C:\WINDOWS\SAUNDRAG.PWL • JAMESH=C:\WINDOWS\JAMESH.PWL • SHARONC=C:\WINDOWS\SHARONC.PWL • MICHELLEM=C:\WINDOWS\MICHELLE.PWL • DAVEP=C:\WINDOWS\DAVEP.PWL • KARENP=C:\WINDOWS\KARENP.PWL

  8. Company Profile • Company Name: Utah Community Credit Union • Company Branch: River Woods • Branch Phone Number: (801) 223 7656 • Company Description: Credit Unionprovidingfinancial services and information • Branch Address: 188 W. River Park Drive Provo, UT 84603

  9. UCCU Construction Loans

  10. User Profile (Primary User) • Full Name: Carol Goldsberry • Position: Construction Loan Specialist • Username: carolg • Email Password: carolg • Email Address: carolg@uccu.com • Work Phone Number: (801) 223 7625

  11. Interesting Findings • Administrative User Password • Carolg email settings and Password • AIF Decode • Corporate Directory • Audit Report • Monthly Technology Newsletter

  12. VMWare Server

  13. Email Information

  14. Email

  15. AIF Decode

  16. Phone Directory

  17. Technology News Letter • “If you haven't already taken the opportunity to test the new system, we urge you to do so before October 2. You can access it by enter BYUALT at the USERNAME prompt when logging into DataSafe. Enter TEMP0 (TEMP "zero") as the password. Your Teller number remains the same and your password is your last name. This is a test directory, so feel free to enter as many transactions as you would like to ensure that it will work for you when we go live. Report any problems to James Hill (ext. 462).”

More Related