For more First Look titles and Syngress offers, go to store.elsevier.com/SyngressFirstLook.
Copyright
Syngress is an imprint of Elsevier
The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, UK
225 Wyman Street, Waltham, MA 02451, USA
First published 2013
Copyright 2013 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangement with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
Trademarks/Registered Trademarks: Brand names mentioned in this book are protected by their respective trademarks and are acknowledged.
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
ISBN: 978-0-12-409505-2
For information on all Syngress publications visit our website at store.elsevier.com
This book has been manufactured using Print On Demand technology. Each copy is produced to order and is limited to black ink. The online version of this book will show color figures where appropriate.
Chapter 1
Case Studies
Introduction
A Day in the Life of a Cybercriminal
Backdating Documents
False Names and Disposable E-mail Accounts
Evidence Leads to More Evidence
Searching for All the Bad Things
ScenarioThreatening Blog Posts
Making the Wrong Kind of Friends Online
A Break in the Case, Otherwise Known as a Suspects Mistake
Altered Evidence and Spoliation
Spoofed Call Harassment
Disgruntled Employee Steals and Deletes Employers Data
Missing Evidence
Bomb Threats by E-mail
ID the Suspect
Online Extortion
Placing Suspect at a Location
Placing the Suspect in the Office at a Specific Location
Stolen Property
IP Addresses Arent Enough
Planted Evidence
The Life and Casework of a Cyber Investigator
Technical Knowledge and Skills
This Case is Different from That Case
Testifying to Your Work
Summary
Bibliography
In theory, investigations should succeed as planned and expected. However, in practice, theory is only the starting point for real-life situations requiring creative solutions to obstacles. A review of case studies provides a means to show theory and practical applications in real-life case scenarios, with both positive and negative results. A thorough examination of one case for a targeted study goes well beyond this book due to the amount of information any single case possesses, but we can use many examples to reinforce investigative concepts.
recovered. So, a statement that electronic evidence may be recovered in a specific situation literally means maybe, because it depends on other factors. Usually, the answer as to whether a forensic artifact of evidence can be recovered is simply, it depends.
Case in Point
This case hinged on the authenticity of a contract between Ceglia and Zuckerberg as it related to the development of Facebook. A forensic analysis was conducted resulting in conclusions that electronic documents and e-mails were manipulated and backdated.
Investigative tips: Antedating is creating files with intentionally inaccurate time stamps. A common antedating action is backdating of electronic documents. Backdating documents is changing the date of a document, such as a business contract creation date changed to an earlier date to gain a benefit. The benefit could be to cover knowledge of a crime or to benefit financially in a business dispute. Another example of backdating could be to create a suicide message after the fact, using a computer in an attempt to cover a murder. The printed date on a document is easy to manipulate and difficult to validate. The electronic time stamp is a different story.
Firstly, examining the metadata of an electronic file gives a baseline of information, whether or not the dates and times are authentic. Each copy or version of the documents under investigation will need the metadata extracted for comparison to create a historical timeline for each document.
In any document backdating investigation, being able to examine the machine on which the document was created may be the most beneficial source of information. Secondary items of evidence that the document may have been copied onto or e-mailed are also important as comparisons.
Documents which have been e-mailed as attachments create a credible source of information in the e-mail headers. A document showing a creation date after an e-mail date would be suspected of being modified. This example would be easy of course, but more important is building the timeline of historical relevance for the documents using all available information, including e-mail header time stamps.
One method of manipulating document time stamps is through the use of software intended for altering metadata. Whether used for legitimate file management or nefarious purposes, these applications enable computer users with average skills to manipulate the time stamps on electronic files. One such example is seen in and easily installed. Once installed, computer users can change the metadata time stamps on any file by right clicking the file, choosing properties, and selecting the TimeStamps tab to alter the metadata.