Computer Hacking Forensic Investigator Case Studies CHFI Case Studies 1 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Exam 312-49 Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 1: Employee Sabotage Kim Stevens is a research scientist working for a pharmaceutical company called Jusco Enterprises. It manufactures human vaccines for polio treatment, which could finally make a breakthrough in the project. Kim was involved in the research for 6 years. According to the company policy, research documents need to be stored in MS Word or Rich Text Format. Critical documents were stored as PDF to prevent tampering. Kim’s research files had 270 pages of sensitive formulae. Recently Kim had a fight with the management for sidelining her while promoting Jack as Senior Scientist. After all the effort and time that she put in, Kim was not rewarded. This made her furious, and so she decided to quit the company. She did not want to part with the formulae that she had come up with her 6 years of work. In a fit of rage she deleted all the critical and research documents so that no one can access them. This act of Kim came to light a week after she left. The enterprise central backup machine was under repair due to which her machine was not backed up during a regular backup cycle. Her most recent work which contained the final formula was not backed up. If the data was not retrieved, the firm stood to lose $3 million in various contracts with the suppliers. The company’s IT department failed to retrieve the data. The company hires you (Who is a CHFI Professional) to investigate the incident and restore the data. How would you investigate this computer crime? 2 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answer: 1. Visit Kim’s desk and seize all the hardware devices which include the following: hard disks, CDROM, Ipods, and DVD disks. 2. Place the devices carefully in anti-static bags and transport them to the forensics laboratory. 3. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 4. Generate MD5 or SHA1 hashes of the bit stream images. 5. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. List the items that you are asked to investigate by the client. a. In this case you are asked to recover deleted files with the content of chemical formulae and mathematical codes. You do not now the name/format of the file. 8. Run a hexadecimal editor and scan the entire image for the keywords. 9. Run undeleted utilities and the entire hard disk to see whether there are any deleted files. 10. If the utility shows up any deleted files, then you should be able to recover them. 11. If you are unable to recover the deleted files, then you should be able to at least recover the portion of the data. View the entire hard disk in the hexadecimal image format and analyze the entire image. 12. If you recognize the content of the hexadecimal data then you should be able to recover the portion of the data using file scavenger utilities. 13. Prepare a professional forensics based on the actions you have taken to restore the data. 14. Print a copy of the report in a PDF format and attached the restored files in an encrypted/password protected CDROM. 15. Deliver the report to the company along with the fee for the forensics service you rendered. 3 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 2: Disaster Recovery Investigation Jason works for the biggest accounting company called H&M Consultants in Dallas, Texas. He prepares financial balance sheet accounting reports to big corporate clients. His deadline to submit the annual tax filing for JacobSun Enterprises was on Friday by 10am. He works hard and completes the entire Tax filing report on Thursday night, and feels that he has done a fantastic report that will boost his promotion opportunities within the company. He leaves for the night and goes home. Jason’s always leaves his computer switched on. The next morning Jason arrives at the office and gets ready to print the document for IRS filing submission. Apparently there was a power outage within the building due to voltage fluctuation. Jason notices that his computer is turned off. So he tries to switch it on, and to his shock the computer fails to boot with the following message displayed: (The NTOSKRNL.exe is corrupted along with serious damage to your data files. Please reinstall the Operating Systems and recover data from backup source). Jason’s computer was not on the network and never backed up. He picks up the phone and calls the company’s IT help desk for assistance. The company IT help desk advises that the data cannot be recovered, and advices Jason to hire a forensics investigator who might assist him in this situation. Jason searches the Google for “skilled computer forensics investigator” and your name pops up as link “We have CHFI on board to investigate all your Computer Forensics needs” Jason looks up your telephone number from the web page and hires you immediately over the phone. How would you investigate the incident? 4 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answer: 1. Visit Jason’s desk and remove the hard disk carefully from his computer. 2. Place the hard disk carefully in anti-static bags and transport it to the forensics laboratory. 3. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 4. Generate MD5 or SHA1 hashes of the bit stream images. 5. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. You are asked to retrieve the following: i. IRS files ii. Spreadsheet files 8. Load the bit stream image as evidence file in Encase Forensic Utility. 9. Encase mounts the hard disk and displays as C: drive. 10. You observe the following: i. The Operating System is Windows XP Professional with SP2 ii. Memory is 2GB iii. The size of C; drive is 30 Gb and he has only one partition 11. You view the boot sector files and notice that you are unable to access files located in this directory c:\windows\systems32. 12. The partition table pointing C: drive was corrupted. This prevented the system from booting. 13. You use Encase Hex Editing utility to fix the partition table. 14. You save the hard disk image and mount it as a primary device in another computer. 15. The computer boots normally and you copy all the IRS Tax files , spreadsheet documents to a DVD ROM. 16. Prepare a professional forensics based on the actions you have taken to restore the data. 17. Print a copy of the report in a PDF format and attached the restored files in an encrypted/password protected CDROM. 18. Deliver the report to the company along with the fee for the forensics service you rendered. 5 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 3: Business Rivalry TargetMac and OneMac are two magazines that cater to the growing Ipod users. The CEO of TargetMac is Bryan Smith and the CEO of OneMac is John Beetlesman. Bryan calls John one day and convinces him to purchase TargetMac. The lawyers of both companies were called in to finalize the deal. The lawyers draft the sale contract, which restricts removal of sensitive and confidential information and non solicitation of TargetMac customers and working staff. A non compete clause was also added in the agreement. It has been two years and John Beetlesman is suspicious about Bryan’s activities. John suspects Bryan has breached the contract. John knows that you are a CHFI professional and provide computer forensics services to his clients. John’s company lawyer Smith Franklyn contacts you to investigate and provide evidence to support the breach of contract so that John can file a lawsuit against Bryan at local civil court in San Francisco, California. How do you investigate this incident? Answer: 1. You want to examine hard disk and laptop computers of Bryan’s home and office for evidence. 2. You ask the lawyer Smith Franklyn to obtain a search and seizure warrant at Bryan’s home located at 37 Albert Avenue, San Jose and his office located at 46, Mathew Street, Santa Monica. 3. Smith Franklyn works with the local District Attorney to obtain the required search warrant. 4. Smith Franklyn and you visit Bryan’s home and seize his computer which is a HP Pavilion Model 1172. 5. You later visit Bryan’s office and seize his laptop, floppy disks and CDROMS. 6. You place the devices carefully in anti-static bags and transport it to the forensics laboratory. 7. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 8. Generate MD5 or SHA1 hashes of the bit stream images. 9. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 10. You are ready for investigation. 6 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 11. You are asked to retrieve: a. Any document in the computer which shows proof for breach of contract. 12. You load the bit stream image in FTK tool kit and browse every single file in the file system. 13. You also read every single email displayed in FTK. 14. After many days/nights of investigation you retrieve the following crucial evidence: 15. Encrypted file titled “Business Plan AppleMac Magazine” 16. Excel spreadsheet “revenuestreams.xls” 17. Numerous email messages back and forth with his investors. 18. You run a password cracking utility to crack the encrypted file “Business Plan AppleMac Magazine.doc” and the password was “planapple”. 19. These above documents clearly indicate that his new business would compete with TargetOnes’s business. 20. You copy these files to a CDROM. 21. You use FTK report facility feature and produce a professional report. 22. You deliver the report to the company along with the fee for the forensics service you rendered. Based on your submitted report the lawyer, Smith Franklyn initiates a $20 million lawsuit against Bryan. After two weeks the court of law holds Smith Franklyn Bryan guilty and asks to pay the amount. Case Study 4: Corporate Espionage Computermania Inc. is the largest computer wholesale company located in Albuquerque, New Mexico. They are the exclusive Dell distributors in the region. Mr. Daniel Moore is the sales manager of Computermania and overlooks sales and distribution operations across the company in the east coast region. Recently Computermania audited the financial accounts through A & T Auditing firm. The management at Computermania was shocked to find that the company incurred $ 7.2 million loss in Dell computer Sales Division. The company was aware that Dell computer sales were on the rise at about 20% every year. They did not believe that this division was losing money. 7 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 They suspect Daniel Moore had something to do with the loss. The auditors A & T went through every financial transaction and noticed that many sales invoices were issued to a company called Raleigh Computermart, Inc. in Dallas, Texas. The invoices were heavily discounted beyond the companies standard discount policy. A & T’s Regional Head Ms. Zelda Stevens is a close friend of your wife Sheela. Ms. Zelda is aware of your computer forensics skills and she contacts you to assist her in the ongoing investigation of Computermania, Inc. How would you conduct the computer forensics investigation to prove Daniel Moore was responsible for the company’s financial loss? Answer: 1. You want to examine the hard disk of Mr. Daniel Moore’s office computer for evidence. 2. You contact Ms. Zelda to access Mr. Daniel Moore’s office on the 17th floor for evidence of his involvement in the crime. She gives you the permission to do so. 3. Later, you visit Computermania office on the 17th floor and seize Mr. Daniel Moore’s company owned laptop for investigation. 4. You place the device carefully in anti-static bag and transport it to the forensics laboratory. 5. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 6. Generate MD5 or SHA1 hashes of the bit stream images. 7. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 8. You are ready for investigation. 9. You are asked to retrieve the following: i. Any information that links Daniel Moore’s involvement related to the financial loss incurred by the firm. 10. You load the bit stream image in Sleuth Kit and browse every single file in the file system. 11. You also read every single email displayed in Sleuth Kit. 12. After two weeks of intensive investigation, you could not find a single evidence that shows Mr. Daniel Moore’s involvement in the financial fraud. 13. You almost want to give up the case. But you decide to visit Daniel Moore’s office to look for other evidences. 8 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 14. You visit Mr. Daniel Moore’s office on the 17th floor and scan the whole office for other evidences. You fail to find any CDROMs, PDAs, Digital Camera, IPods; the only evidence was his laptop which you had already investigated but with no success. 15. You notice a Xerox Model 1703 Color Photocopier on the hallway at 17th floor. 16. This photocopier was used by all the office staff on the 17th floor. You walk towards the Xerox photocopier and take a look. You notice that it is a very advanced color photocopier powered by embedded Linux operating system. 17. You pick up the phone, call Ms. Zelda and ask her whether you can remove the hard disk of the photocopier for investigation. She gives you a “Go ahead”. 18. You place the device carefully in anti-static bag and transport it to the forensics laboratory. 19. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 20. Generate MD5 or SHA1 hashes of the bit stream images. 21. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 22. You are ready for the second round of investigation. 23. You load the bit stream image in Sleuth Kit and browse every single file in the file system. 24. You also read every single email displayed in Sleuth Kit. 25. The files were located in a directory with date on it. The files were stored as “Tiff” image file format. 26. You view every image and come across an image which attracts attention. 27. This image contains 10 pages of balance sheet and ownership transfer data of the company Raleigh Computermart, Inc. 28. The Xerox 1703 Color Photocopier stores every single photocopy made on the machine for 7 days before it gets deleted. 29. The Tiff document contains evidence in which Mr. Daniel Moore has 51% ownership in the Raleigh Computermart, Inc. 10. You copy these files to a CDROM. 11. You use Sleuth Kit report facility feature and produce a professional report. 30. You deliver the report to Ms.Zelda at Computermart, Inc. along with the fee for the forensics service that you have rendered. Mr. Daniel Moore was dismissed after it was discovered through the forensic evidence that he had concealed ownership interest in Raleigh Computermart, Inc. 9 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 5: Pornography Natasha Gabriel is an attractive woman who is in her early 20s. She works as an Advertising Manager for the firm Cosmopolitan-Ad Agency. She is a sexy woman who always makes lewd remarks about her male colleagues. One day you receive a phone call from the CEO of Cosmopolitan-Ad Agency, Mr. Mark Dwendler asking for your computer forensics investigation services to assist him in the internal investigation of Natasha Gabriel downloading pornography images and other inappropriate materials on her PC. You send a quotation of $10,000 fees for a 3 day investigation for Natasha Gabriel’s case. Mark agrees to the quotation. How will you proceed with Natasha’s computer crime investigation? Answer: 1. Visit Natasha’s desk and remove the 80GB Seagate hard disk carefully from her HP Pavilion office computer. 2. Place the hard disk carefully in anti-static bags and transport it to the forensics laboratory. 3. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 4. Generate MD5 or SHA1 hashes of the bit stream images. 5. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. You are asked to retrieve the following evidence files: a. Pornography images b. Pornographic videos 8. You load the bit stream image in FTK tool kit and search for image (jpeg, gif, bmp, tiff) and video (mpeg, dat, avi, mov) files in the hard disk image. 9. FTK search comes up with pornographic images and video files in the following directories: a. C:\Documents and Settings\Conference\My Documents\My Pictures b. Internet Cache (C:\Documents and Settings\Temporary Internet Files\Content.IE5 ) 10 Settings\Administrator\Local Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies c. Exam 312-49 Deleted files in Recycle Bin d. C:\Documents and Settings\Conference\My Documents\My Videos 10. Most of the pornographic images and video content are related to “Lesbian Sex activities” . 11. You copy these files to a CDROM. 12. You use FTK report facility feature and produce a professional report. 13. You deliver the report to Mr. Mark Dwendler and issue an invoice to Cosmopolitan-Ad Agency for the payment of your service. Based on your report Natasha Gabriel was fired from the company for breaching the clause 3.1 (a) mentioned in the Employment Agreement. 11 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 6: Virus Attack First Commercial Bank is a private bank which caters to 600o customers in Rochester, New York. A virus called “MaMia.w32” hit the computers at First Commercial Bank. This virus infected the bank’s 200 computers. As a result, all the data was lost. The “MaMia.w32” virus formatted the entire hard disk upon infection. All the computers in the bank are backed up every Sunday at 7.00 P.M. The virus infected on Saturday 2.00 P.M. So one week of work was lost. Nick Madison in a frantic voice calls your Super Computer Forensics Company, which is located in Atlanta, GA and requests your professional service. Nick asks you to recover the data from all the 200 computers infected by the virus. You tell Nick that you will need 10 computer forensics professionals to assist you with this investigation and will cost him lots of money, to which Nick says, “Money is not an issue as long as the data is recovered successfully”.. How will you investigate this incident? 12 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answers: 1. Imaging 200 computers; assuming the capacity of each hard disk is 100GB, you will need to make at least 2 bit stream copies of the original hard disk. (It is a forensics rule). 2. That means 2 x 100 GB x 200 Computers = 40,000 GB of data storage space to begin investigation. 3. Your forensic laboratory does not have a storage capacity of such a large size. 4. You call freelance computer forensics investigators in Rochester if they would like to join with you in the investigation. They agree after negotiating a high per day fees with you. 10 of the freelances join you for this investigation. 5. You and your forensics team visit the First Commercial Bank and remove the virus infected hard disks from the computers. 6. Place the hard disks carefully in anti-static bags and transport it to the forensics laboratory. 7. Your forensics laboratory is piled up with the hard disks of the First Commercial Bank. 8. You rent 50,000 GB EMC rack servers from the Disaster Recovery Centre Inc. in New York City. 9. The Disaster Recovery Centre Inc. sends you the huge racks in a special truck to your forensics laboratory. 10. You and your team of forensics investigators make a bit-stream image of the hard disks using tools such as FTK and Encase. 11. You also generate MD5 or SHA1 hashes of the bit stream images. 12. You prepare the chain of custody and store the 200 original hard disks in a secure location. You would be investigating the bit stream image copies. 13. You take a single hard disk image to study the possibility of recovering the data. 14. You use R Drive to load the image to a free partition on the local computer. 15. The loaded image shows as D: drive of 70 GB. 16. You scan the D: drive and notice that all the files have been deleted and the drive is not readable. 17. You install the “Handy Recovery” utility and view the deleted partitions from the D: drive. It shows that 5 partitions have been deleted. 18. You restore all the 5 partitions along with the deleted files to your local C: drive. You also note that all recovered files are intact and in good condition. 13 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 19. The reason why you could successfully restore the data was that the deleted data was not over written with other data. 20. You follow the same procedure to successfully recover the data in the remaining 199 hard disks. 21. You call Nick and tell him that your team was successful in restoring the data and how he would like the recovered data to be delivered to him. 22. Nick tells you to format the existing hard disk and load the recovered data on each hard disk. 23. Your team produces a forensics report and delivers the report along with the 200 hard disks to Nick. 24. You disk wipe the data on the rented EMC storage servers and return the servers to the Data Recovery Centre Inc. 25. You charge First Commercial Bank for your professional services as follows: a. Your team consists of 10 investigators plus you. In total you are an 11 member team. b. Your team works 8 hours a day for 4 days. c. Your team charges $200 per hour. d. The rental charges for EMC storage servers costs you $ 8000 for 4 days. e. Transportation charges for the rented EMC rack servers, hotel charges, car rental, and airfare for travel to New York and back costs you $ 20,000. f. Your professional fees for the forensics investigation service costs $18,000. g. Total Cost = 8 x 200 x 10 x 4 + 8000 + 20000 + 10000 = $110,000. 26. You invoice First Commercial Bank for your service rendered. 14 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 7: Sabotage Keith Robertson works in Sancong Mobile Manufacturing Company in Barcelona, Spain. This company designs mobile phone interfaces and GUI for popular vendors. Sancong has become market leader within a short time. Keith was involved in design of the latest Motorola Razor phone. He managed to design a GUI interface for the phone which rivals Apple’s Ipod designs. The company uses Maya 3d application to design the work. He was proud of his design and had secretly planned to offer the design to Sancong’s competitors. He contacted Sancongs’s competitor Jentech and struck a deal in selling them the design. A week later, Keith tendered his resignation to Sancong and left the company. Sancong’s engineers were shocked to notice many of the mobile phone designs at Keith’s computer were missing. Millions of Dollars were spent on Research and Development for these designs, especially the new Motorola Razor phone design. This situation looks bad on Sancong. Keith had sabotaged the designs before he left the company. Keith’s system was never backed up due to high confidential nature of the work. Only Keith had access to these designs. The CEO of Sancong Mr. Julian Rod was very disturbed. The company stands to lose millions of Dollars if the designs are leaked out. Sancong planned to patent the designs, so that they can license the technology to mobile telephone manufacturers around the world. Mr. Julian Rod has read successful stories of your computer forensics investigation around the world. He is also aware of the fact that you are a respected CHFI professional and a CEH. He hires you to investigate and provide evidence of Keith’s sabotage, and to retrieve the data. How will you investigate this incident? Answer: 1. Visit Keith’s desk and remove the hard disk carefully from his Dell Dimension 372 office computer. 2. Place the hard disk carefully in anti-static bags and transport it to the forensics laboratory. 3. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 4. Generate MD5 or SHA1 hashes of the bit stream images. 5. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. You are asked to retrieve the following evidence files: a. Presence of any evidence related to Keith’s role in the sabotage. b. Retrieval of data related to designs. 15 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 8. You load the bit stream image in FTK tool kit and search for the Maya 3d graphic design files. 9. FTK search shows you zero results. 10. You search for deleted data, deleted partitions and slack space. FTK again shows you no results. The other files are intact without any corruption except the missing Maya 3d files. 11. FTK shows you that there are 11,200 files present in the hard disk. 12. You start analyzing every single file in the hard disk which is time consuming. 13. You come across one interesting file called”BeastMan.exe” in c:\Windows\System32 directory. 14. You become suspicious about this file and you search in Google to investigate more about this program. 15. The “BeastMan.exe” program is used to permanently wipe data from the computer so that recovery of the files is impossible. 16. At this stage of the investigation you suspect that Keith would have used this program to destroy the Maya 3d graphic files. 17. You want to confirm the suspicion. 18. You call up Mr. Julian Rod and ask him to send the back up tapes of the router, firewall, DHCP, IDS and proxy server log files. 19. Next day a FedEx box arrive from Mr. Julian Rod with 4 sets of Sony backup tape. 20. You create bit stream images of these tapes and load them through FTK. 21. You search the proxy log files called “checkpointproxy.dat” using the search string “BeastMan.exe”. 22. FTK returns few results 10.0.0.7 64.233.189.104 10.36.12 17/08/2006 http://www.google.com/search?hl=en&hs=VSa&client=firefoxa&rls=org.mozilla:enUS:official_s&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=how+to+perman ently+delete+Maya+3d+file&spell=1 16 10.0.0.7 207.3.4.4 wipers/BeastMan/index.htm 10:37:03 17/08/2006 GET/Trojans 10.0.0.7 207.3.4.4 wipers/BeastMan/beastman.jpeg 10:37:13 17/08/2006 GET/Trojans 10.0.0.7 207.3.4.4 wipers/BeastMan/help.txt 10:37:22 17/08/2006 GET/Trojans Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 10.0.0.7 207.3.4.4 wipers/BeastMan/contact.htm 10:37:33 17/08/2006 GET/Trojans 10.0.0.7 207.3.4.4 wipers/BeastMan/rule.htm 10:37:40 17/08/2006 GET/Trojans 10.0.0.7 207.3.4.4 wipers/BeastMan/beastman.exe 10:37:51 17/08/2006 GET/Trojans 23. Based on these logs, you confirm the machine at 10.0.0.7 searched in Google for utility that securely deleted Maya 3d files from the system. 24. The machine at 10.0.0.7 visited a site located at 207.3.4.4 and downloaded a program named “beastman.exe”. 25. You need to extract evidence; which machine used IP address 10.0.0.7 on 17/08/2006 at 10:37. 26. You note the DHCP log file called dhcp.log and start searching 10.0.0.7 and 17/08/2006. 27. FTK shows you one result. The text is as follows Lease duration; 180mins, DHCP scope:0, IP 100.0.7, subnet mask 255.255.255.0, MAC 00-11-11-A0-5A-47 28. You confirm that the computer at Sancong with the MAC address of 00-11-11-A0-5A-47 was used to download the BeastMan program. 29. You conduct further investigation and confirm that the Mac address belongs to Keith’s computer. 30. You would need to prove that Keith was at his desk at that particular time, and he was the one who downloaded the program. 31. You call up Mr. Julian Rod and ask him what physical security policies and authentication system, the company uses in the building for its employees. 32. Mr. Julian replies that every employee has a company id card and must use this card to access every department section they enter. He also said that there are CCTV cameras present at the ceiling of every department in the company and the images are recorded to DVD drives 24x7. 33. You ask Mr. Julian to send you the log files of physical access card data and copies of CCTV DVD recordings. 34. The next day you receive from Mr. Julian a FedEx box with the above items. 35. New access control log files are created every day of the week. You search through the access control log file named “acccntrl170806”. 36. You see an entry like this: Acc3742 EMP2316 Keith Robertson 17 08 06 10:24:34 cardscan Status: success Room: 37 17 Auth Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. type: Computer Hacking Forensic Investigator Case Studies Exam 312-49 37. The above log confirms Keith Robertson used his card to gain access to Room 37. This confirms that he was present at his desk while “BeastMan.exe” was being downloaded. 38. This does not prove that Keith was the one who downloaded it. It could be the act of someone sitting on his computer while Keith was elsewhere in the department. 39. CCTV video recordings are created and stored as new files everyday on a DVD. 40. You scan through few DVDs and locate the DVD file “CCTVrecording170806.mpeg”. 41. You play the above file in Windows Media Player and position the frame to time 10:36:00 42. You see Keith Roberson sitting in front of his computer seriously looking at his computer screen while talking to someone on the phone. 43. This proves Keith was the one who downloaded the file and destroyed the data. 44. You have the necessary evidence of Keith’s hand in the sabotage. But the files could not be recovered as the hard disk was wiped out using “BeastMan.exe” 45. You copy these files to a CDROM. 46. You use FTK report facility feature and produce a professional report which includes the evidence from DHCP logs, Access control logs and CCTV disc. 47. You deliver the report to Mr. Julian Rod and issue an invoice to Sancong Mobile Manufacturing Company for the payment of your service. Based on your evidence, Mr. Julian Rod files a lawsuit against Keith Robertson for sabotage and destruction of confidential data. Mr. Julian Rod is claiming $6.7 million as damages. 18 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 8: Child Pornography GlobalDVD is a multinational company, headquartered in San Antonio, Texas; with branch offices in Atlanta, Los Angeles, New York and Chicago. GlobalDVD manufactures DVD covers and produces DVD discs for big movie companies such as Warner Brothers, Paramount Pictures and Universal Studios. The company’s annual turnover exceeds $8 Billion. The Atlanta Operations is headed by Robert Stevens. The CEO of GlobalDVD Mathew Jacobson suspects that Robert has been using the company’s disk duplicating machines for illegal purposes. The disc duplicating machine consists of a rack of Dell servers with 10 DVD writers installed. It is meant to produce multiple discs of DVD from a single ISO image. Mathew confronts Robert about any illegal activity going around in the Atlanta manufacturing plant because he had heard rumors about the same. Robert coolly denies the accusations. After two weeks Robert sends an email to Mathew saying that the disc duplicating machine has been stolen. The insurance company was involved in the investigation. Later, one of the office employees states that the disc duplication machine was on sale on eBay for $ 5000. The picture on the machine posted on eBay confirms that it is the GlobalDVD’s disc duplicating machine. The seller was from Pakistan. Mathew buys the machine using his credit card. Mathew calls you to help him to nail Robert. How would you investigate this incident? 19 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answer: 1. You visit Mathew’s office and pack the disk duplicating machine. 2. You carefully transport it to the forensics laboratory. 3. You open the disc duplicating machine carefully and remove the hard disk which has a capacity of 1.5 TB ( 1500 GB). 4. You create a bit-stream image of the huge hard disk using dd command in Linux. 5. Generate MD5 or SHA1 hashes of the bit stream image. 6. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 7. You are ready for investigation. 8. You are asked to retrieve: a. Any evidence of Robert’s illegal activities 9. You mount the hard disk image in SleuthKit Autopsy program in Linux. 10. You search for files in the disc and find nothing. The disc is completely empty. You understand the eBay seller in Pakistan has deleted all the files before putting up the machine for sale on eBay. 11. You load Linux undelete utilities and run a thorough scan on the hard disk image. 12. You are find the following interesting files that were deleted: a. 1200 Jpeg files b. 700 gif files c. 2000 Mpeg files d. 3500 xls document e. 7000 .htm files f. 13 iso files 13. You extract all the files on your PC and view them. 14. You are totally SHOCKED to find child pornography images as part of the deleted files. 15. Things get serious now. You start viewing the word documents and you find one interesting file that is labeled as “ahmedinvoice.doc”. You open this file and have a look. It is an invoice sent from Robert Stevens to Ahmed Jamaluddin in Islamabad, Pakistan billing him for 2000 DVDs of “Sex with 10 year old Little Angie-never seen footage” 16. The invoice shows evidence that Robert used the GlobalDVD’s disc duplicating device to make the child pornography DVDs and sold the discs along with the machine to a buyer in Pakistan. 20 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 17. You scan through the deleted iso files and you recover a file called angie.iso 18. You load this in your Myhome2DVD player. 19. You are “TOTALLY SHOCKED TO FIND CHILD PORNOGRAPHY VIDEO OF A LITTLE GIRL CALLED ANGIE” 20. You immediately stop the investigation at this point. 21. You call Mathew and inform him that you have a possession of evidence that needs to be handed over to the local law enforcement agency and seek his advice how to proceed with the investigation. 22. Mathew replies that he would get his company’s lawyer to contact FBI to take over the case from you. 23. Mathew says to stop the investigation immediately and secure it until the FBI arrives. 24. You conclude the investigation by handing over all the evidence to the FBI. 25. You delete the local copies of all evidence files of child pornography images and videos on the local computer permanently using a hard drive wipe utility. 21 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 9: Steganography Joan Shelly works at Texas National Bank in Dallas, Texas as corporate loan officer. She resigned from the bank recently. Don Johnson the CEO of the Bank suspects that Joan used her position to send confidential loan information to someone outside the bank. This investigation must be carried out in complete confidentiality due to FDIC requirement. Don calls you to investigate and prove Joan’s crime, which is theft of confidential data. How would you carry out this investigation? 22 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answer: 1. You ask Don to send the hard disk of Joan Shelly’s computer to your office for investigation. 2. You also give Don instructions on how to remove the hard disk from the computer and how to package it for transportation. 3. Don complies with your request and sends you the hard disk through one day FedEx shipping. 4. You create a bit-stream image of the hard disk using dd command in Linux. 5. Generate MD5 or SHA1 hashes of the bit stream image. 6. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 7. You are ready for investigation. 8. You are asked to retrieve: a. Evidence of transmission of confidential documents to others. 9. You load the image in Encase and search for files. 10. Encase shows you zero results. 11. You scan for deleted partitions and scan for formatted partitions but with no results. 12. Without any valid data in the hard disk you are unable to continue with the investigation. 13. You pick up the phone and call Don and tell him that there is no data on the hard disk for you to continue with the investigation. 14. Don replies that the Bank’s IT department Zaps the entire hard disk of every outgoing employee with unrecoverable disk wipe program. 15. You tell Don “That makes sense!” 16. You ask Don if you can have copies of mail server logs for investigation. He says “That’s possible” because his company backs up the log files with the exchange server everyday. 17. The next day you receive a FedEx envelope containing CDs of exchange log files. 18. You scan through the exchange server log files and you find that Joan has been sending a mail with no messages to henry@xsecurity.com 19. You see that there are about 10 emails sent to this address with no message but with an attachment of blank text file with no data in it. 20. You are wondering “why did she send so many emails with empty blank files?” The size of the blank files is 500kb. 23 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 21. You suspect the blank files contain steganography code. 22. You scan the blank files with the snow steganography utility. Amazed you see the confidential customer loan profiles of 6000 banks’ customers! 23. This evidence shows that Joan used steganography to conceal the data and send them to a third party outside the company. 24. You prepare the report in a PDF format and deliver the evidence CD back to Don along with an invoice for your professional service. Don initiated a lawsuit against Joan Shelly for theft of confidential information. 24 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case 10: Trademark Infringement Martin Spencers, Inc. is a clothing manufacturing chain in San Jose, Texas. They had designed the latest collection of Men’s Summer Shirts. These designs were considered unique in the marketplace. They have spent many years in developing these designs. Martin Spencers also trademarked these designs. They published these designs on the Internet in 2005 for custom licensing. Another company Jaco Designs based in London had a similar design and was offering them for sale worldwide. The CEO of Martin Spencers, Mr. Alfred Stonwell was shocked to know that Jaco Designs had copied the designs from his company. Mr. Alfred filed a trademark infringement lawsuit against Jaco Designs in London. The lawyers at Jaco Designs argued that their client created the designs first and had not seen or heard about the Summer clothing designs from Martin Spencers. They also argued that they have not even seen the designs at Martin Spencers website www.martinspencersx.com in 2005. Jaco Designs claims that the designs created by them are original. Mr. Alfred calls you (the forensic investigator) to prove them wrong. How would you handle this trademark infringement case? 25 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answer: 1. You would need to prove that Jaco Designs was aware of your Summer Shirt designs. 2. Martin Spencers published the entire catalog with the disputed designs on the website on 3rd March 2005 3. You should look for evidence that shows the staff at Jaco Designs visited the website at www.martinspencersx.com 4. Ask Alfred whether they have kept the backup copies of web server log files for the past two years. The current year is 2006. 5. Alfred checks with the IT department and arranges to send you backup tapes of IIS web server log files since the year 2004. 6. The next day you receive a FedEx box from Alfred which contains 20 backup tapes. 7. You copy the data from all the tapes to your hard disks. There are about 300 GB of data. 8. You prepare a chain of custody and store the backup tapes in a secure location 9. You check the Jaco Designs company’s IP address at Netcraft by searching the domain name www.jacodesignsx.com 10. Netcraft shows you the IP address of the domain is 207.3.3.3 11. You double check this IP address by using DNS reverse lookup and confirms that it resolves to 207.3.3.3 12. Now you are ready for a serious search. 13. You search the entire IIS logs using Microsoft IIS log parser utility for IP address 207.3.3.3 14. 207.3.3.3, -, 10/13/04, 2:55:14, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog.gif 207.3.3.3, -, 10/13/04, 2:55:14, W3SVC2, Martinsp, 3223, 200, 0, GET, /summerdesign-catalog.htm 4502, 163, 207.3.3.3, -, 10/13/04, 2:55:16, W3SVC2, Martinsp, 3223, 200, 0, GET, /summerdesign-catalog.htm 4502, 163, 207.3.3.3, -, 11/23/04, 13:05:50, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog2.gif 207.3.3.3, -, 11/23/04, 13:05:50, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog2.htm 207.3.3.3, -, 11/23/04, 13:05:52, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog2.pdf 26 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 207.3.3.3, -, 03/03/05, 10:55:20, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.gif 207.3.3.3, -, 03/03/05, 10:55:21, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.htm 207.3.3.3, -, 03/03/05, 10:55:23, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.pdf 199.7.8.2, -, 03/15/05, 10:55:20, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.gif 199.7.8.2, -, 03/15/05, 10:55:23, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.htm 199.7.8.2, -, 03/15/05, 10:55:24, W3SVC2, Martinsp, 4502, 163, 3223, 200, 0, GET, /summerdesign-catalog3.pdf 15. The above log entry proves that the company Jaco www.martinspencersx.com and downloaded the pdf document. Designs had visited 16. You also note an IP address 199.7.8.2 accessed the Summer Design catalog that month. 17. A search in Google for the IP address shows you it resolves to Jaco Designs Law firm, Manchester Law Associates which is located in London. 18. This proves that not only the people at Jaco Designs had seen the Summer Shirt designs but also that the law firm of Jaco Designs had visited the website www.martinspencersx.com 19. You prepare the report in a PDF format and deliver the evidence CD back to Don along with an invoice for your professional service. 20. Based on your forensics evidence, Martin Spencers was awarded $2.3 Million by the London High Court for willful trademark infringement. 21. Jaco Designs plans to appeal the case to the London Supreme Court. 27 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case 11: Encrypted Documents Mason Stevens works as software programmer at IT-Defense Solutions Pte. Ltd. in Singapore. He was involved in programming the Ballistic Missile Management application. It was a topsecret project, and he was the only one involved in the project. No backups were made due to the sensitive nature of the project. Mason had written about 200,000 lines of C++ source code and had almost completed the project. Mason resigned from the company due to work pressure and internal office politics. He submitted the entire project on DVD discs to the management including the documentation for the project to his boss Mr. Lloyd Seen. He had cleared his desk and left the company for another IT job in Japan. Mr. Lloyd looks at the submitted DVDs and finds about 230 C++ source code files but the core source code component (hook.dll and bindc.dll files) for the Ballistic Missile project was encrypted and password protected. Without these files the entire project is useless. Mr. Lloyd is under tight pressure to show a full working prototype of this application to prospective buyers from Russia in 2 days failing which the company would lose the entire contract, which is worth several million dollars. Mr.Lolyd might also lose his job for no show. Mason’s whereabouts is unknown at this stage. Mr. Lloyd calls you, the forensic investigator to unlock these files. How will you do it? 28 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Answers: 1. You ask Mr. Lloyd to send you a copy of the core source code component in a CD. 2. Next day you receive a shipment from Mr. Lloyd through FedEx. The shipment contains the CD which had the core source code component. 3. You create a bit-stream image of the CD using dd command in Linux. 4. Generate MD5 or SHA1 hashes of the bit stream image. 5. Prepare the chain of custody and store the original CD in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. You are asked to retrieve: a. Crack the password on the file component.zip 8. You load up the password cracker application called “Advanced Zip Password Recovery” and launch brute force dictionary attack on the file component.zip 9. You leave the program running. 10. In six hours the password recovery tool cracks the password of the encrypted file component.zip 11. The crack password is “juggyboy97X” 12. You copy the files to a CD. 13. You prepare the report in a PDF format and personally deliver the evidence CD to Mr. Lloyd the same day along with an invoice for your professional service. 14. The entire investigation was concluded in 8 hrs. 29 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case 11: Expert Witness A highflying lawyer in Georgia Mr. Bond Level is handling a divorce case of Mr. and Mrs. Steve Rally. Mr. Bond represents Steve while Mr. Green Smith represents Steve’s wife Sheela. Mr. Bond had presented forensic evidence of several e-mail messages as evidence to prove that Sheela was having an extra-marital affair with her hairstylist and was cheating on her husband. This is the reason why Steve was seeking a divorce. In Orange County civil court, the lawyers argue about the validity of the e-mail evidence. The lawyer, Green Smith emphasizes that his client never sent the e-mail messages, and it should not be accepted as evidence. Mr. Bond needs to prove that the e-mail messages are in fact authentic. He calls you (forensic investigator) to visit the courtroom as expert witness. How will you proceed? Answers: Court Scene at Orange County Local Civil Court You take the stand as expert witness. [Mr. Bond Level]: Please state your name and designation. [You]: My name is Jonathan Shelly and I am the Forensics Investigator at Data Forensics Communications Inc. [Mr. Bond Level]: Can you please state your qualifications? [You]: I have a Masters of Security Science (MSS) degree from EC-Council and have a Bachelors Degree in Information Technology from New York University. I also hold various professional certifications such as MCSE, CISSP, CEH, CHFI and CCNA. [Mr. Bond Level]: Wow! That is very impressive Mr. Jonathan. What experience do you have in the field of computer forensics? [You]: I am a Computer Hacking Forensics Investigator and I hold the CHFI certification from EC-Council. I also attended formal 5 day training on the above certification. [Mr. Bond Level]: Those are your professional qualifications. What the Court would like to know is your experience in investigating computer forensics cases. [You]: I have attended many corporate sexual harassment internal investigations involving computers. I have investigated various terrorist related cases for the Homeland Security Department. 30 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 [Mr. Bond Level]: Could you discuss these cases so that we know how qualified you are? [You]: I am sorry I won’t be able to discuss the cases here as I have signed a non disclosure agreement with my clients, unless the court issues me an order. [Mr. Bond Level]: That’s alright. Have you published any books, whitepapers, articles etc? [You]: I have written a book titled “CHFI Study Guide” for McGraw-Hill. I have contributed many articles at http://portal.eccouncil.org. I have also presented papers at various Hacker Halted conferences around the world. [Mr. Bond Level]: I agree you are a computer forensics expert. Can you please take a look at Exhibit A, which contains the email messages sent from Mrs. Sheela Rally to her hairstylist, Mr. Rouba Bandoras? Could you tell me if this email message is a legitimate message? Return-Path: <shellyd@xjewellery.com> X-SpamCatcher-Score: 1 [X] Received: from [207.3.3.3] (HELO xjewellery.com)by fe3.xjewellery.com (CommuniGate Pro SMTP 6.1.2) with ESMTP-TLS id 61258719 for roubx@xmenc.com; Mon, 23 Aug 2004 09:40:10 -0400 Message-ID: <4129F3CA.2020509@xjewellery.com> Date: Mon, 23 Aug 2004 09:40:26 -0400 From: Sheela Rally <shellyd@xjewellery.com> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Rouba Bandoras <zroubx@xmenc.com> Subject: Your Sexy Girl Alone at home Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Message: Dear Rouba Bandoras, My husband is going on a business trip to Italy on the 25th of this month. He will be back on the 29th. Let’s meet at our usual hotel Hilton Suite 333 at 8.0 PM tomorrow. I will wait for you with roses, red wine and no clothes on me :) Its party time honey! Today is very special because we are celebrating 20 weeks of our secret affair. With lots of love Sheela Rally [You]: Yes, I investigated this email header and I confirm the following: • 31 The email was sent from Sheela Rally to Rouba Bandoras. Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 • The IP address of the email server was correct and it was routed through 207.3.3.3 which confirms her domain xjewellery.com • I have computed the Message ID of the SMTP server and it is accurate. [Mr. Bond Level]: In other words this email message cannot be forged, right? [You]: Yes [Mr. Bond Level]: Could you tell the court, if there any possibility for the message to be bogus [You]: No. The message server logs also show that the message id and the date sent matches with Microsoft Outlook’s data from Mrs. Sheela Rally’s computer. [Mr. Bond Level]: Are you sure? Very sure? This message is authentic and cannot be forged? [You]: Yes [Mr. Bond Level]: (you look at the judge) That’s all Your Honor. [Judge]: Mr. Green Smith, would you like to cross examine the Expert Witness? [Green Smith]: Yes Your Honor. You walk up to the witness stand. [Green Smith]: Mr. Jonathan Shelly, could you tell me exactly what technical skills do you possess? [You]: I’m sorry I do not understand the question [Green Smith]: Let me rephrase the question. What Internet server technologies and client technologies have you mastered till today? [You]: I have worked with UNIX, Linux, Mainframe computers, Internet Programming Languages, Microsoft Windows 2000, XP, 2003, Firewalls, IDS, Proxy servers, Routers etc. I have 20 years of experience in the IT field. [Green Smith]: You have stated that you have conducted a forensics analysis on Mrs. Sheela Rally’s computer and found the IP address to be the same on the server log files. Am I right? [You]: The evidence file analysis was conducted using Encase, which was linked to …. Green Smith interrupts you! [Green Smith]: Please answer yes or no. Judge intervenes. [Judge]: Mr. Jonathan Shelly please answer the question. [You]: (Looking at the judge) Yes Your Honor [You]: Yes 32 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 [Green Smith]: Could you explain to the court what unique message id was created by the SMTP server? [You]: The message id was calculated by the SMTP server program using MD5 algorithm [Green Smith]: What is MD5 algorithm Mr. Jonathan Shelly? [You]: MD5 is a secure hashing function that converts an arbitrarily long data stream into a digest of fixed size. It is conjectured that the difficulty of coming up with two messages having the same message digest is on the order of 2 64 operations, and that the difficulty of coming up with any message having a given message digest is on the order of 2 128 operations [Green Smith]: Thank you Mr. Jonathan Shelly. So this message cannot be duplicated using another identical message id. Am I right? [You]: Yes [Green Smith]: Based on your experience, your professional qualifications, your technical competency, is the email message authentic and cannot be forged? [You]: Yes [Green Smith]: Please take a look at Exhibit A and note the SMTP server CommuniGate Pro 6.1.2. Can you tell me what that is? [You]: CommuniGate Pro is a SMTP server program for Linux Operating System and is widely used on embedded computers [Green Smith]: The email header shows that the message was routed through CommuniGate Pro 6.1.2 server. Am I right? [You]: Yes [Green Smith]: Once again based on your thorough investigation on the SMTP log files and Sheela Rally’s computer hard disk image the message was routed through CommuniGate Pro 6.1.2 server, Yes or No? [You]: Yes. 100% right! [Green Smith]: Mr. Jonathan Shelly, I searched in Google for the term “CommuniGate Pro 6.1.2” but could not find any results. I contacted several Linux professionals and asked them if there was ever CommuniGate Pro 6.1.2 and their answer was No. The latest version was 4.1.2. I contacted the company vendor Stalker Corporation and asked them if they ever produced CommuniGate Pro 6.1.2 server and their reply was No. Also they mentioned that the banner message of SMTP server cannot be altered. (You hand over Exhibit C to the Judge an email text message send from Stalker communication to Green Smith) [Green Smith]: Mr. Jonathan Shelly, please take a look at Exhibit A and tell me if this email header is accurate and not forged [You]: (pause…….pause……pause...) mmm…I’m not sure 33 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 (You look at the Judge) [Green Smith]: This email message cannot be accepted as evidence. Thank you Your Honor. (The Judge dismisses the email message as crucial evidence in the divorce case) Note: Please make sure you conduct a thorough forensics investigation and be able to justify the report 100% in the Court of Law. You just lost the case. 34 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 12: Racial Discrimination Dr. Kent Rogers is a leading skin specialist in Bronx, New York. One day, Raj Khanna who is of Indian origin visits the doctor to treat his black pigmentation skin allergy. The doctor after conducting several clinical tests refuses to treat Raj for his allergy on the face and asks him to take treatment from New York National Skin Center. The following week Raj files racial discrimination lawsuit against Dr. Kent Rogers in New York civil court for having refused to treat him. Dr. Kent Rogers hires you (forensic investigator) to prove his innocence. How will you handle this case? Answer: Dr. Kent Rogers discusses with you the series of threatening emails send by Mr.Raj Khanna. Mr.Raj Khanna wanted refund on his treatment. 1. You visit Dr. Kent Rogers’ clinic. 2. You remove the hard disk from Dr. Kent Rogers’ laptop. 3. You place the device carefully in anti-static bags and transport it to the forensics laboratory. 4. You create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 5. You generate MD5 or SHA1 hashes of the bit stream images. 6. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 7. You are ready for investigation. 8. You are required to retrieve: a. Email messages sent by Dr. Kent Rogers to various Medical Practitioners around the world discussing Mr.Raj Khanna’s treatment which proves Dr. Kent Rogers’s innocence. 9. You use Paraben's E-mail Examiner to analyze the emails sent by Dr. Kent Rogers using MS Outlook 2003 using his email id drkentrogers@kentrogerscl.com 10. Paraben’s E-mail Examiner analysis shows series of emails sent by Dr.Kent Rogers to Medical Practitioners around the world enquiring about the continuation of treatment to Mr. Raj Khanna for his black pigmentation skin allergy. 35 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 11. The emails reveal the fact of other doctors warning Dr. Kent Rogers not to proceed with the particular treatment to Mr. Raj Khanna as he was suffering from a pigmentation allergy which was serious in nature. If the treatment was continued the condition of Mr.Raj Khanna would aggravate, and they also recommended that he seek treatment from New Skin Allergy Hospital. 12. These series of emails proved that the charges filed by Mr. Raj Khanna against Dr. Kent Rogers are false. 13. You prepare the report of your forensics analysis in a PDF format and personally deliver the evidence CD to Dr. Kent Rogers along with an invoice for your professional service. 14. Dr. Kent Rogers hires an attorney to fight his case. Based on your forensics analysis and the attorney’s legal explanation, the District Court Judge dismisses the racial discrimination case against Dr. Kent Rogers. 15. Dr. Kent Rogers lost many clients due to the bad publicity in the press. 16. Dr. Kent Rogers files for a defamation case against Mr. Raj Khanna for a sum of $ 500,000 36 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case Study 13: Katherine was found murdered under the far eastern side of San Francisco Bridge. Her body was taken to the forensics laboratory. They examine her body and conclude that she was raped and murdered. The local police launch an investigation into the murder. They want to nab the culprits and the way she was murdered. The chief investigator Mr. Marty Smith visits Katherine’s house and collects details about her from her parents. Katherine was a 16 year old teenager studying at Lassie High School at Madison County at San Francisco. She had lots of friends and used to hang on with them quite often. Mr. Marty Smith visits Katherine’s room and collects various evidences like pillows, bed sheets, greeting cards and handbooks. He also comes across Katherine’s IBook Laptop which was in her room. Her dad Simon said, “Katherine used to spend late hours night on the Internet, we thought she was studying”. Mr. Marty Smith takes the laptop along with him to the local county office for investigation. Mr. Marty is not an IT professional, so he does not know where to begin. He calls you to help him out with his criminal investigation. Answer: 1. You visit Mr. Marty Smith’s office. 2. Remove the hard disk from Katherine’s IBook laptop. 3. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 4. Place the hard disk carefully in anti-static bag. 5. Generate MD5 or SHA1 hashes of the bit stream images. 6. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 7. You are ready for investigation. 8. You are asked to retrieve the following: a. Internet cache files, chat history of MSN messenger, Temporary Internet Files. b. Outlook contacts, emails and any other evidence which would be of help in the investigation. 9. You load the image in Encase and search for files. 10. The search does not reveal any specific result. 11. You run MessenPass to crack the password of Katherine’s MSN id. Her MSN id was “katsinlovev2@msn.com”. 12. MessenPass cracks Katherine’s password. Her password is “myloveeric4521” 37 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 13. You logon to her MSN messenger. 14. You search her chat history. You notice a particular MSN id “erichulklover27@msn.com”. The chat sessions show that Katherine has been constantly interacting with the person using this particular id. 15. The chat session revealed Katherine’s affection and love towards this individual who claimed to be from Boston and was of 27 years of age. 16. A series of emails from Katherine’s outlook revealed the plan made by “erichulklover27@msn.com” for a meet at a pub “The Hunter’s Paradise” near San Francisco, a day before Katherine was found dead. 17. Based on the above findings the local Police visit the pub “The Hunter’s Paradise”. 18. The police check the record of transactions made by customers for the past one week. 19. Katherine’s photograph was shown to the bar tenders and the manager of the pub who confirmed of her presence at the pub two days back. They had seen her with a tall man with good looks in his late 30s. 20. The police scanned the credit card transactions in detail and they were able to zero down on one particular transaction made by a person called Eric Newman. The payment was made for two 45 ml of Scotch whisky and one 45 ml of Gin. 21. The police were sure of the person involved in the crime as MSN id of the person found on Katherine’s IBook laptop “erichulklover27” and the name of the person who visited the pub along with Katherine matched. 22. Further investigations revealed more interesting details about the couple who visited the pub two days back. 23. Mr. Marty Smith contacts the credit card company “GreatCards” whose card was used by Eric Newman. “GreatCards” Operations Manager Mr. Luther Rock extended his help to the police investigating the case. 24. The personal detail along with the contact address (Home/Office) was handed over to Mr. Marty Smith by Mr. Luther Rock. The home address of Eric Newman as per the personal detail was at Merrimac Street, Boston, MA 02114. 25. Mr. Marty Smith along with other police officials leave for Boston. Mr. Marty Smith asks you to join him for the investigation at Boston. 26. The police contact the Local Court at Boston and issues a search and seizure warrant against Eric Newman. 27. Eric Newman is taken into police custody. 28. You remove the hard disk from Eric Newman’s HP Presario PC. 29. Place the hard disk carefully in anti-static bags and transport it to the forensics laboratory. 38 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 30. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 31. Generate MD5 or SHA1 hashes of the bit stream images. 32. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 33. You are ready for investigation. 34. You are asked to retrieve the following evidence: a. Internet cache files, chat history of MSN messenger, Temporary Internet Files. b. Outlook contacts, emails and any other evidence which would be of help in the investigation. 35. You run MessenPass to crack the password of Eric Newman’s MSN id. 36. MessenPass cracks Eric Newman’s password. Her password is “myloveeric4521” 37. You logon to his MSN messenger. 38. You search his chat history. You notice a particular MSN id “katsinlovev2@msn.com”. This MSN id belonged to Katherine The chat sessions show that Eric Newman had been interacting with Katherine using this particular id for the past 6 months. 39. There were other girls listed on his MSN messenger buddy list. From his chat history you conclude that Eric Newman had indeed met Katherine on the fateful day. He had plans of meeting other girls listed on his chat list. 40. The police questions Eric Newman. Under pressure he breaks down and confesses to the crime. The medical records of Eric Newman showed that he was a “schizophrenic”; patient of mental disorder which was due to a depressed childhood. Katherine accompanied him to his home where he sexually abused her and later murdered her after she threatened to report the incident to the Local Police Department. 41. Mr. Marty Smith thanks you for helping the Local Police Department in solving the case. 42. You prepare the report of your forensics analysis in a PDF format and personally deliver the evidence CD to Mr. Marty along with an invoice for your professional service. 39 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case study 14: Terrorist Attack A terrorist was shot down at Heathrow International airport. He was planning to bomb the Mason International airport at Fiji. His face matched with the terrorist list. He tried to escape when the police confronted him; eventually they shot him. He was carrying a laptop briefcase when he was shot down. Mr. John Wales, the Chief Investigator at The Heathrow Police Department calls you for a professional investigation services. You are asked to investigate the items in the brief case. How would you investigate this case? Answer: 1. To investigate this case you are given the laptop bag along with the Dell Laptop which the terrorist had at the time of confrontation with the police, photographs of the crime scene, and fingerprints matching the terrorist. 2. You find the computer in a “Stand By” mode. 3. You take photographs of the computer screen using your “Cannon Digital camera” for evidence. 4. You notice that the Operating System in use was Microsoft Windows XP Professional Service Pack 2. 5. You insert the Helix CDROM and collect the volatile evidence such as programs that are running, ports which are open, open Explorer windows. 6. You copy the “pagefile.sys” 7. You check the date and time as shown by the Operating System. 8. You copy individual memory processes to a Sony USB stick without hampering the contents of the original hard disk. 9. You do a formal shutdown of the Windows XP Operating System. 10. You unscrew the Dell Laptop and remove the hard disk. 11. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands. 12. Place the hard disk carefully in anti-static bag and transport it to the State Forensics Laboratory. 13. Generate MD5 or SHA1 hashes of the bit stream images. 14. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 15. You are ready for investigation. 40 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 16. You are asked to retrieve the following: a. Any MS Word, Excel, PDF, Images files (jpeg, giff, bmp, tiff), video files (avi, mpeg, dat, mov) and audio files (mp3, wav and rm) related to the case. b. MS Outlook contacts, email messages, messenger chat history, cache files, Temporary Internet files. 17. You load the image in Encase and search for the above mentioned files. 18. Encase search gives you the following results: a. 50 contact lists from Outlook b. 25 video files c. 132 image files d. 12 PDF files e. 34 MS Word files f. 3 MS Excel sheets 19. You notice that the video files had contents related to the following: a. 9/11 Bombings b. Video showing terrorists practicing at a terror camp c. Killing of kidnapped hostages d. Motivational speeches by leaders of various terrorist outfits e. Personal videos which showed the terrorist spending some light moments with his wife and two small kids f. A 30 minute video of the Heathrow International Airport and Mason International airport at Fiji g. Videos taken in a hotel room along with 6 other suspects 20. You make a detailed list of the videos and prepare a document explaining each of the videos in brief. 21. There were photographs of Heathrow International Airport and Mason International airport at Fiji. The terrorists had taken the snaps of these two airports in detail, which confirmed the intention of the terrorist group to which he was associated. 22. There were few logos of a particular terrorist group which confirmed his association. 23. Documents related to “How to make chemical bomb”, “How to prepare for Jihad” , “How to be a suicide bomber” along with other materials were also recovered. 24. One particular document “How to bomb Mason International airport” caught your attention. You read the document and find that the article contains instructions from 41 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 few people on how to spread terror at Mason International airport, Fiji. You are more than assured about his involvement in the crime. 25. With the help of Encase, you are able to get the list of contacts in the terrorist’s MS Outlook. These contact names matched to the ones found in earlier documents. 26. The Excel sheets found had bank account names and the details of inflow of funds to the accounts. 27. The laptop bag had few documents and immigration visas which made clear of his links with other terrorist organizations. 28. You prepare the report of your forensics analysis in a PDF format and personally deliver the evidence CD to Mr. John Wales along with an invoice for your professional service. 42 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 Case study 15: Ipod- A Handy Tool For Crime Xdata Enterprises is an online storage company based in Albuquerque, New Mexico. The company had a major share in the online storage market. John Cruise, the CEO of Xdata Enterprises believed in free work environment at his office. Physical security measures were not given priority at Xdata Enterprises. Ron Smith was working as a lead Storage Architect with Xdata Enterprises. He was the senior most employee in the Offline Storage Department of Xdata Enterprises. He had worked hard for a new Product “ MyOfflineStorage”, which Xdata Enterprises were about to release in a couple of months. He was expecting a 40% hike in his salary after the monthly review. All hopes of Ron were washed away when Yuri Wellington, his colleague and member of the key project “ MyOfflineStorage” was given the maximum credit during the performance review. Subsequently Yuri got a hike of 45 % on his salary. Few months later SecureOffline Storage Inc, a competitor company based in St. Louis, Missouri launches a product which is similar to Xdata Enterprises’ “ MyOfflineStorage”. John suspects Ron for selling the blueprint of MyOfflineStorage to SecureOffline Storage Inc. He calls you, the forensic investigator to investigate this case. Answer: 1. Visit Ron’s desk and remove the hard disk carefully from his HP Pavilion office computer. 2. Place the hard disk carefully in anti-static bags and transport it to the forensics laboratory. 3. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 4. Generate MD5 or SHA1 hashes of the bit stream images. 5. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 6. You are ready for investigation. 7. You are asked to retrieve the following evidence files: Presence of any evidence related to Keith’s role in the sabotage. 8. You load the bit stream image in Encase and search MS Outlook for emails related to the sabotage 9. You search the “Sent” folder in MS Outlook but fail to find any attachments related to the blueprint of the project, that was sent through email 43 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Computer Hacking Forensic Investigator Case Studies Exam 312-49 10. You search for deleted data, deleted partitions and slack space. You come across an exe file ImageHide.exe. You become suspicious of Ron’s activity. ImageHide is a Steganography tool to hide information in image files. 11. You search for image files( jpeg, tiff, bmp, gif). You come across more than 20000 image files. To analyze each file for stegonagraphic content will be time consuming. John had asked you to investigate the case in 2 days as he plans to sue SecureOffline Storage Inc for Corporate Espionage. His company’s share was falling as each day passed. 12. You get to know from his peers that Ron used an Ipod to listen to Music while on the job. 13. You ask John to get Ron’s Ipod for investigation. 14. You stored the Ipod in a static free bag and mark as evidence 15. Create a bit-stream image of the hard disk using tools such as FTK and Encase. 16. Generate MD5 or SHA1 hashes of the bit stream images. 17. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy. 18. You are ready for investigation. 19. Encase recovers all files present n the Ipod including the deleted ones 20. You notice an image file called “blueprintimp.jpeg”. The size of the image file was 800kb. 21. You open the image file . The image turns out to be Ron’s Photograph. 22. You try to open the file “blueprintimp.jpeg” using StegDetect, a steganalysis tool. 23. You find information related to the product embedded into the image file. 24. You prepare the report of your forensics analysis in a PDF format along with an invoice for your professional service Based on your investigation and evidence found, Ron was arrested by the Local Police Department. Ron confesses to the crime. John sues SecureOffline Storage Inc for corporate espionage for a sum of $15 million 44 Computer Hacking Forensic Investigator Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.