Assessment Criteria (Marks Breakdown)
Please note that during the preparation of your assignment documentation, you must include the following marking table. Ensure you fill in the details of your full name and student ID.

Name/ Student ID:
Preperation of the executive summary and legal warrants (10)
Documentation (10)
Conclusions/recommendations (10)
Referencing (10)
Evidence identification and preservation (15)
Critical analysis and evaluation of the case (15)
Q&A session during presentation (30)
Total (100)

The marking table must be placed on a single page, located as either the second or third page of your final assignment documentation.

Contents
EXECUTIVE SUMMARY 2
AUTHORIZATION 3
IDENTIFICATION 4
COLLECTION AND PRESERVATION 5
Mr. Mike’s Work-Station 5
TTBANK Server 5
CHAIN OF CUSTODY FORM 7
EXAMINATION AND ANALYSIS 8
EVIDENCES RECOVERED 8
RECONSTRUCTION 11
RELATIONAL ANALYSIS 12
CONCLUSION & RECOMMENDATION 13

EXECUTIVE SUMMARY

This is the case involving the staff of TTBANK that was suspected of misuse of company property due to that staff bragging about gaining access to privileged information to his colleagues that he should have otherwise not have gotten access to.
The issue first came to the attention of Mr. Ali, the Enterprise Systems Administrator of TT Bank who had investigated silently to discover the identity of the staff and that the person was a member of the Loans Department and his name was Mr. Mike. What became particularly disturbing was that Mike worked in the Loans Department and should not have any access whatsoever to any Human Resources (HR) department files.
The Enterprise System Administrator decided that the case should be investigated properly and hired a computer forensic expert from the APIIT FORENSIC LABOROTARY.
Upon arrival, the forensic investigator was issued full authority to conduct the search and began conducting the investigation on site at TTBANK’s own work-station that was used by Mr. Mike immediately.
The work-station was found to be in switched off state, so only the hard disk image was acquired. The image size for Mr. Mike’s work-station was 4GB while the HR server image size was 8GB.
An analysis of the system showed that Mr. Mike had actually installed some very sophisticated computer programs for system monitoring on his work-station. These tools seemed to be an attempt at gaining access and privilege escalation on the TTBANK network, which was later accessed from his work-station via Windows “Remote Access” tool. This discovery and other serious violations led to the investigation into the TTBANK’s HR Server in order to ascertain in detail what actually happened and discover possible damages that were done. It was found that Mr. Mike had only accessed the HR server to retrieve the employee salary information and nothing else, based on the evidences analyzed.
The full investigation and activity logs are provided in detail below.
AUTHORIZATION LETTER
Please find below the authorization letter:
20th August 2010
Mr. Abdullahi Gara
TPM,
Bukit Jalil, Kuala Lumpur, Malaysia
The Investigator, APIIT FORENSIC LABS,
Re: TTBANK.Co Internal Investigation
On the 18th of August, it has been brought to the attention of the Enterprise Systems Administrator of TT Bank, Mr Ali that a staff, Mike, had been bragging about knowing the salary of many different bank employees. The Systems Administrator found that Mike works in the loan department and should not have access to any Human Resources (HR) files.
TT Bank has a policy that relates to the proper use of bank computers.

Therefore on behalf of TTBANK.Co and the Authority vested in my job title here in the Bank, I request you conduct a thorough investigation into the incident and also act with the knowledge that you have been given full authority over any work-stations within the Bank premise so far as it is within the realm of your investigation.
Please note: Our policy states that no programmes may be installed on any computer without the written permission of the IT Director, and that any attempt to circumvent passwords or obtain unauthorized access to bank files will be grounds for termination or legal prosecution. Also IT staff are allowed to install any network monitoring devices, including sniffers or other packet capture devices, to maintain network security or to investigate possible abuses.
Any information or data retrieved is the sole property of TTBANK.Co
Sincerely,
Ali Medvedev
Enterprise Systems Administrator
IDENTIFICATION

The identification of the evidence was done upon arrival on the crime scene. All necessary forensic precautions were taken during this process, the precautions include; taking snapshots of all the devices and the ports that were connected to them, tagging all ports and devices before taking a snapshot and unplugging them, checking the state of the devices that were connected to the suspects computer and also noting if the suspects computer was in an off state or sleep mode.
The evidence details are identified and listed below.

EVIDENCE IDENTIFICATION FORM

Name of the case: Internal TTBANK Investigation & Enquiry
Description: Investigation of an employee’s attainment of classified information.
EVIDENCE 1
Description: Hard disk image of Mike’s Work-station
Hard disk Brand/Size: Seagate/4GB

File System: NTFS format
Location of evidence: An employee’s (Mr. Mike’s) office space/cubicle.
EVIDENCE 2
Description: Hard disk image of TTBANK H-R Server.
Hard disk Brand/Size: Seagate/8GB
File System: NTFS format
Location of evidence: TT Bank Server room.

COLLECTION AND PRESERVATION

Mr. Mike’s Work-Station
Upon arrival at the investigation site, in this case was Mr. Mike’s office space, the work-station was found in a switched-off state. From this point on the investigator inserted the Ubuntu Live CD and acquired the image using .dd commands, the md5 and SHA1 hash values of the image were then calculated and compared against the hash values of the hard disk on Mr. Mike’s Work-Station for verification purposes. The chain of custody form was filled up and the details added to it in order to preserve the evidence authenticity.

Image showing the md5 and SHA-1 hash sums of Mr. Mike’s Work-station.

TTBANK Server
The investigation of the server was undertaken when the it was discovered that Mr. Mike had indeed gained access to the server via windows “Remote Access” mode and had potentially viewed or downloaded a file to his work-station that contained information related to the other employees of TTBANK.
The Server had already been in a state shut down for routine maintenance when the investigator arrived at the conclusion that the server should also be investigated. The hard drive of the server was removed and attached to a write protect device before the image was acquired again using Ubuntu Live CD’s .dd commands. The md5 and SHA1 values were both computed and compared both to the image acquired and that of the server hard disk itself.

Image showing the md5 and SHA-1 hash sums of TTBANK HR Server.

CHAIN OF CUSTODY FORM EXAMINATION AND ANALYSIS
EVIDENCES RECOVERED FROM MR. MIKE’S WORK-STATION
1. “TT BANK STAFF RECORDS” file found on the image of Mike’s work-station is identical to the file that is on the TTBANK HR Server.

2. Key logger “Refogger” was discovered on the Mr. Mike’s work-station. This revealed information as to how he was able to access the TTBANK’s HR server from his work station. The keyloggers records show that it had captured key strokes of the Administrator of the HR server as he tried to log onto the server remotely from Mike’s work-station.

3. “Remote Desktop” access from Mr. Mikes work-station to the Server was captured by the key logger “Refogger” that Mr. Mike had most likely installed himself.

4. Another program called “nmap” and “Winpcap” were also found installed on his machine, what it does is scan the IP address of a computer system and reveals various vulnerabilities that it has such as open ports etc… This is proven by the multiple scan logs left on his machine indicating failed attempts to scan the network which the HR server was located on.
RECONSTRUCTION
FUNCTIONAL ANALYSIS - TOOLS USED BY INVESTIGATOR AND FOR WHAT PURPOSE
Tools Purpose
Ubuntu Live CD Used to acquire the images using .dd commands
Ubuntu Live CD Used to compute the md5 and SHA1 hash values of the images and the hash values of the hard disk on Mr. Mike’s Work-Station and the TTBANKHRSERVER for verification purposes
Forensic Tool Kit Used to mount the images acquired by the investigator and conduct the examination and analysis
Microsoft Excel Used to open retrieved evidence in excel format

RELATIONAL ANALYSIS
TOOLS USED BY PERPERTRATOR TO COMMIT THE CRIME
The relational analysis section reveals the malicious tools that were discovered on the suspect’s computer during the investigation. The Forensic analyst believes these tools were used by the suspect to commit various offenses. The tools and offenses committed are listed below.
Crime Functionality Tools
Remotely accessing the HR Server Access the Server via windows “Remote Access” features, viewed and copied files. Windows Remote Access.
Key Stroke Logging Took the key strokes of the Administrator Username and Password Refogger/KGB Keylogger
Port scanning Used to scan for vulnerable ports Nmap & WinpCap

CONCLUSION & RECOMMENDATION

Finally, in light of such activities carried out by one simple staff member with having basic knowledge of vulnerabilities and off the shelf hacking tools, it is important for the administrator to act in hardening rules on when and where to access the server in order to prevent any future occurrences of this magnitude. In order to accomplish the investigator suggests the following.
• Format and re-install the HR Server.
• Frequently change user passwords
• Change all passwords used on the HR Server immediately.
• Update Windows to up-to-date version for all work-station and input restrictive measures that can enforce TTBANK’s security policy.
• Perform integrity check on HR server regulary.
• Harden work-station rules.