Exposing Criminals Using Digital Forensics - Case Study Example

Digital Forensics IN THE GEBERAL COURT The Digital Audit Team (The USA) Claimant Clyde barrow and Bonnie Parker Defendants Action brought against the defendants for being involved in fraud relating to processing and use of counterfeit money and publication of misleading information to the public. Digital Forensics Introduction Digital forensics is a branch of the forensics department which mainly focuses on the uncovering and interpreting digital information from various sources such as in the hard drive of a computer for various purposes. Example, data recovered through this method may be used as evidence in a court of law. Digital forensics mainly focuses on is in the cyber crimes. They use various techniques to recover the data which would be necessary to catch the parties which are involved at that particular moment[ CITATION DBa10 \l 2057 ]. The aim of digital forensic process is to safeguard any evidence in its original state while conducting a structured investigation by collecting, categorizing, and validating the digital data for the purpose of getting information regarding a particular past event. In a digital forensic case, it mainly involves three processes that are important for the retrieval of the information which is needed. The three processes are: 1. Acquisition: This is the process where the information which is in the hard drive that is in the investigation is duplicated and the information is blocked or the writer is blocked so as to prevent the information that is on the hard drive to be altered or modified. 2. Analysis: At this stage, the information which was found in the hard drive is examined carefully. This stage involves scrutiny of the data by the experts in preparation to present evidence in the court of law. This evidence can be retrieved by using various techniques such as key word searches, whereby they will search for items such as the list of the names or account numbers and such like things. 3. Reporting: In this part, the experts involved should provide a vivid report on their findings in regard to the case under study or investigation. Summary This report scrutinizes the involvement of Clyde Barrow in fraud. The investigation also covers the fact that if Clyde Barrow and Bonnie Parker had been communicating. In the investigation conducted it was established that Clyde Barrow was involved in the fraud, in addition it was established that the two suspects had been communicating with each other. Also we were able to establish that Clyde Barrow was involved in terrorism activities. The evidential facts are as follows: 1. Clyde Barrow was dealing in counterfeit money. This can be proven by the fact that there were images of the counterfeit money in his hard drive. The images upon investigation, were found to be illegal, i.e. they were not legal tender. 2. Clyde barrow and Bonnie Parker not only knew about each other, they had been communicating via e-mail. In our investigations, we were able to establish that the two had in fact had exchanged e-mails. For instance, we had found an e-mail from Bonnie Parker to Clyde Barrow, but then Clyde Barrow had not replied to it. Clyde Barrow could have stated that he did not know Bonnie Parker. In such a case we would not have had proof of the two individuals having prior knowledge about the others existence. Fortunately, for us these two had exchanged e-mails about a certain pact meaning they were business partners in the fraud. How can we prove this? To answer this, we go back to the e-mail, it stated that; “You can put that thought right out of your mind!!! Not until we have our bank accounts all nice and fat”. This means that they were waiting for a deal to push through for which they would be paid large sums of money. 3. Clyde Barrow was also involved in producing fake identification cards. In his computer hard-drive, we found out that he had different identification cards of an individual who was called Jonathan Smith. In these identification cards, the individual has the same name and also photographs but his titles kept on changing. In one of the photographs, he is a bounty hunter; in another he is a bar man and in another it is labeled as back stage pass. Why did he have the identification cards of this individual in his computer hard drive? Instructions Scenario of the Case The case the case under investigation is of a financial fraud. The people involved in this case are: Clyde Barrow and Bonnie Parker. The two are co-imperators who are suspected to be involved in this fraud. These two individuals have both stated that they have heard about each other but they have never had any personal communication[ CITATION NBe09 \l 2057 ]. One of the suspects, Clyde Barrow was recently found in possession of counterfeit money. This resulted in his arrest and, his computer was seized. In our investigations we were supposed to establish two critical effects: 1. Whether Clyde Barrow is involved in this fraud. 2. To find out the link between Clyde Barrow and Bonnie Parker. The investigations involved forensic studies on the hard disk that we acquired from Clyde Barrow. The areas that we focused on were: 1. Deleted/ Hidden Partitions 2. Data in the unallocated space in the hard drive that was obtained. 3. The deleted folders that were in that hard drive. 4. Suspicious files had to be looked at critically. 5. Windows registry was screened for any relevant evidence. 6. The recycle bin was scrutinized to see if there was any evidence. 7. Other external devices that were available were also scrutinized such as the Printer data[ CITATION DBr02 \l 2057 ]. Issues In this case, there are several issues which need to be addressed critically so that we can come up with the facts and logical conclusions to the case. The issues and the questions which need to be addressed are: 1. Was there a fraud committed? 2. What type of fraud was committed? 3. Which parties were involved in this fraud? 4. Is there proof via evidence that the fraud actually occurred and the named people were the master-minds behind it? 5. Can one find the link which will show that the people who have been mentioned knew about each other, and that they were involved in this fraud? 6. What was the source of our information? 7. How do we derive our information? 8. Which were the soft-wares that we used so as to derive the necessary information which we needed in this investigation? In regards to this case, we will show clearly the type of fraud that was committed. We will also show the people who were involved. In so doing, we will have proven that there was a fraud committed by the said parties. We will also provide the documents and other necessary materials as evidence, which will help us to show how and when the fraud was conducted. The source of the information was a hard drive which we confiscated from Clyde Barrow after we found him in possession of counterfeit money. We also, took his printer and conducted some preliminary investigations on these items. We used two soft-wares which assisted us to derive the information. These two soft-wares were; Encase and FTK[ CITATION RMe09 \l 2057 ]. The Curriculum Vitae Name of the Expert: Derrick Graven Affiliation: The Graven Forensic Agency Qualifications: Experts in providing physical forensic analysis. Experts in retrieving data: Experts in using the FTK and Encase Soft wares Experience: 12 years experience Documentation These include the documents and the materials that we used when we were carrying out our investigations. Most of the documents we found in the possession of Clyde Barrow by searching his computer. We searched the following areas: - Deleted - Hidden partitions - Deleted folders - Data in the unallocated space - Suspicious files/ Signature Analysis - Compound files - Windows registry - Recycle bin - File information from removable storage/ deleted volumes - Printer data From these sources, we were able to come up with a report in accordance to this case. Chronology During the investigation, we found some documents that indicated to us that there was fraud. In the evidence that we collected, it was linked to Clyde barrow because; the items we found were in his computer. We were also able to retrieve evidence that proves Clyde Barrow and Bonnie Parker, not only knew about each other but they had been communicating prior to the start of this investigation. During our investigations, we saw that Clyde was involved in more than one criminal activity. The criminal activities that we saw Clyde Barrow was involved in included: 1. Dealing with counterfeit money. This is what led to his immediate arrest in the first place. 2. We also found that he was making fake identification cards. 3. He was involved in terrorist activities. This we saw by the various documents that we found in his possession that indicated that he was selling ideas and documents that could help people make bombs[ CITATION MTP09 \l 2057 ]. The Evidence In relation to dealing with counterfeit money, the following images were found in his computer from the various sources which we had earlier on mentioned. The images indicated that he was dealing with counterfeit money. We also know for sure that he was printing this counterfeit money using his printer; this because, images of counterfeit money were found in his printer. To prove this we provide what we found in his computer[ CITATION AJu07 \l 2057 ]. Events as they Happened In this section we are going to present the events as they occurred and as we found them. In the plaintiff’s hard drive, we were able to retrieve images from various locations, which were images of counterfeit money. The images comprised of notes of several denominations. The images, we found in these locations: Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 MD5: 47DD67DCF0788C7DE5DCF0498BF46E25 SHA1: 41E06FED548DB2FB14602355DC1615E6862EBD34 In this location, the image was a symbol of what is contained in the 100 dollar bill. This image was found in the Recycler of the plaintiff’s computer hard drive[ CITATION ECC09 \l 2057 ]. This means that the plaintiff had tried to delete the image so as to cover the evidence. The second image that we found was found in this location: Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 From recycle bin MD5: FA51C478EEEB38E0EE5E75EE0D91537D SHA1: 2F4202FB1737E193CE7E4990821229AA88D045CD This was the same image as the one we have talked about in the first image. Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 MD5: C3324BCF474B0D1BB5F33A69376AD877 SHA1: 8042F4D3C7E5D35F785700F2E283650D3F4EB634 The third image that we found was serial numbers which are usually in the legal tender. These serial numbers are an actual proof that the money is legal tender. However, the serial numbers were not valid since they were already in circulation. This image was retrieved in the following location of the computer’s hard drive: Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 From recycle bin MD5: E32DE369E6957A2996818A24768258EF SHA1: 727F41D81226BDDF8046C255CE68DD1B25682D88 The fourth image that we found was that of the back side of a one hundred dollar bill. This image was found in two locations of the plaintiff’s computer hard drive. This is a clear proof that the plaintiff had plans of making counterfeit money. The locations where the hard drive was found at were as follows: Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 From recycle bin MD5: F7456BA98A0EE40A7F94E552D3B72028 SHA1: 2F6AAD7BED444D6437BA2B1C22A7EE00BD3A4CA8 Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 Form recycle bin MD5: D42B206A9A4E88D4AEB85BE8EAA283CE SHA1: 272B9466BF473C6E81338F2BC6ADFA2553E64804 Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 From recycle bin MD5: 3896EF0989534E68A880A4E370808DE2 SHA1: 200A7EE1CEB7D22E17DBFC34789392307F3581BD Also we were able to retrieve images from the plaintiff’s hard drive which showed us the images of the front side of the 100 dollar bill. This bill contained the picture of the president, and, it had all the necessary symbols which are in an original 100 dollar bill. On a close look on the properties of the images, we discovered that the images had previously been edited using some soft wares like Microsoft publisher, Photoshop. The images of the money were found in the following locations upon our investigations of the money. The locations are as follows: From recycle bin Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 MD5: AA2B8526F3601A6E900BC69C7FB318C3 SHA1: 97D10F788BA4A9A26F0D10C285A459C55140EF79 As we were conducting our investigations, we came upon cheques that showed us that Clyde Barrow had made the following payments: 1. He had paid Melissa D Volchok money through a cheque which was valued at $907.30. 2. He had also made payments to the National Life Fidelity Insurance Company through a check amounting to $550. These documents were found in the following locations: Found: Documents and Settings\Clyde\Work\Check Stock MD5: D8CCE41690F2966982E553DB16CE1EA1 SHA1: 9610081856043B1F96F673953E08EE6271FBB684 Found: Documents and Settings\Clyde\Work\Check Stock DUPLICATE MD5: D1242FD6AF0736BE920A27FBFAE93CA6 SHA1: 47DB7A6CAEBDC3969D3F3DC2152930D5CE7370B7 In the plaintiff’s hard drive, we were able to retrieve documents which showed us that the plaintiff was in possession of identification cards of a different individual. In the following locations, we found an image of Jonathan Smith working at different places. In one of these images, he is a bartender, in another he is a bounty hunter, he has one which is giving him access to a backstage of a certain event and one in which it is his driving license. The locations where we found these evidences are listed below: MD5 hash: E8F346CFC4B9AEF6F2D88EDAE4EF5F46 SHA1: 710B78B6E0E5AE09160F5915781BBD30FF3A94A3 Path: Y11\Part_1\NONAME-NTFS MD5 hash: 96F16F8EA6B772A0EC281BB9CF3D5D95 SHA1: 257C7910AAFA2FC3C520607B4DB3D2FB84D567EF Path: Y11\Part_1\NONAME-NTFS MD5 hash: F548695E021FB3449F8FA80BC7044786 SHA1: 47788B374AE78BBE932102512F562F9871CC327B Path: Y11\Part_1\NONAME-NTFS MD5 hash: C696D32B80C791BAB49CAC97ABD54D38 SHA1: 2698E07B9B8EA2B792E4D6A29208EED2F3537F29 Path: Y11\Part_1\NONAME-NTFS MD5 hash: 5939D23C23F0EC0C553AF0DBB2735855 SHA1: 739A06E751F663FB6504E9F72811650A4D06F5BE Path: Y11\Part_1\NONAME-NTFS During our investigations also, we were able to establish that not only did Clyde Barrow and Bonnie Parker know about each other, but they had also been communicating for some time. To confirm this, we found an e-mail which stated that; “You can put that thought right out of your mind!!! Not until we have our bank accounts all nice and fat”. This e-mail was sent from Clyde Barrow whose e-mail is c barrow07@hotmail.com, to Bonnie Parker, whose e-mail is bonnie777@hotmail.com. This e-mail had been sent on 28/10/2002 at 13:10:52. There was also another e-mail which had been sent on 22 October 2002 at 6:34 am. It had been titled “Some Good Ones”. It had been sent by Bonnie Parker and Clyde Barrow received this message. All this we found in the hard drive upon our investigation at the following location: MD5 hash: E57AFDB0149C0B65BCF215EA9B9683F9 SHA1: 321E5D32CFF14EEDCC68EBB9CF7D1714623A78F0 Path: Y11\Part_1\NONAME-NTFS\Documents and Settings\Clyde\Local Settings\Application Data\Identities\ {F26026AE-4F64-4BC4-A7D4-3136B9B705AD}\Microsoft\Outlook Express\Hotmail - Sent Items.dbx Md5 hash: BF691E23E1DB9E3B5934B68333B1CF1E SHA1: A05492DF70ADC6ACD9C7FDAB1C78E60A695FF91B Path: Y11\Part_1\NONAME-NTFS\Documents and Settings\Clyde\Local Settings\Application Data\Identities\{F26026AE-4F64-4BC4-A7D4-3136B9B705AD}\Microsoft\Outlook Express\Hotmail - Sent Items.dbx Upon conducting further investigations, we saw that the plaintiff had sent various e-mails to various people indicating that he could help them make homemade bombs. One of the e-mails was written as follows: “Military Technical Manuals for sale. Greetings I am currently selling Military Technical manuals. These manuals were specifically made with the intent to train soldiers on how to manufacture Explosives and Ignition systems behind enemy lines with normal everyday items. The difference between these manuals is the depth and specificity with which each one covers explosives. Either way, these are the actual texts not copies stapled together. They are each at least 100+ pages in length. Here they are including the asking price... There are in-depth designs of manufacturing pistols, rifles and recoilless rocket launchers from scratch. Also there are timed delays for explosives, the in-depth manufacture of napalm, other flammable gels and detonators and, all types of explosives”. This information was found in the following location of the computer’s hard drive: Found: Clyde's HDD\C\Documents and Settings\Clyde\My Documents\Explosives and Bombs\Homemade Explosives.htm Merging software in the plaintiff computer was another indicator that the plaintiff was using it to merge the front images to produce a complete note. The location of the software was as follows: Clyde’s HDD\ C\Documents and Settings\ Program Files\ Merge Magic. Technical Background To retrieve the information and the evidence that we have presented in this case, we used the following soft-wares: FTK and Encase. FTK stands for Forensic Tool Kit. This software is used by Forensic investigators to look for the information which is needed in a case by scanning the hard drive of the computer. This software can be used for the following purposes: 1. Locate deleted e-mails. 2. It also contains a disk imaging program which is known as the FTK imager. This imager usually saves the image that is or was in the computer and then it can calculate the MD5 value. This MD5 value will be able to prove that the information or the data has been authenticated as useful and that it was found in this computer. This will result to it displaying an image as will be shown in the appendices. The images that will be displayed will be a proof that they were found in the plaintiff’s computer hard-drive. Encase on the other hand is a software program which is used by forensic investigators in order to get specific information from the computer. It is a very important program as it can be used to retrieve data from the hard drive no matter where its location is. It is a very efficient program because it makes the work of Forensic investigators easy. The advantage of using Encase is that the software maintains the integrity of the evidence that one will retrieve from the hard disk of the computer. In our analysis and investigation, the two programs helped us a lot. We were able to not only find the information that we were looking for, but we were also able to find the location of these documents. Also in the report, they are things such as the MD5 hash. What this means is that; the MD5 hash is an algorithm which is used as a security measure in order to check if the data that somebody has found has authenticated. This means that; if the data contains the MD 5 hash, it means that this data is true and its location has been verified. SHA-1 means Secure Hash algorithm. In this algorithm, the main function of the algorithm is also to prove the authenticity of the data that was retrieved. These two algorithms: MD 5 hash and SHA-1, if there are in any data retrieved document then it means that the location in which this data was found in is the true location. In our investigations we were able to establish the following: 4. Clyde Barrow was dealing in counterfeit money. This can be proven by the fact that there were images of the counterfeit money in his hard drive. The images upon investigation, were found to be illegal, i.e. they were not legal tender. 5. Clyde barrow and Bonnie Parker not only knew about each other, they had been communicating via exchange of e-mails. In our investigations, we were able to establish that the two had in fact exchanged e-mails. If for instance we had found an e-mail from Bonnie Parker to Clyde Barrow and then Clyde Barrow had not replied it, Clyde barrow could have stated that he did not know Bonnie Parker. In such a case we would not have had proof of the two individuals having prior knowledge about the other`s existence. Fortunately for us, these two had sent each other e-mails about a certain deal meaning they were business partners in the fraud. How can we prove this? To answer this, we go back to the e-mail, it stated that; “You can put that thought right out of your mind!!! Not until we have our bank accounts all nice and fat”. This means that they were waiting for a deal to push through in which they would be paid large sums of money. 6. Clyde Barrow was also involved in producing fake identification cards. In his computer hard-drive, we found out that he had different identification cards of an individual by the name Jonathan Smith. In these identification cards, the individual has the same name and also photographs but his titles kept on changing. In one of the photographs, he is a bounty hunter; in another he is a bar man and in another it is labeled as back stage pass. Why did he have the identification cards of this individual in his computer hard drive? Clyde Barrow is also involved in terrorism activities. He may not be directly involved, but he has played a critical role in terrorism. In his computer drive, we found various documents which linked him to terrorism activities. In one of the documents, an e-mail, he states that he will show people how to make homemade bombs using the normal materials found in a homestead. The e-mail states that: “Military Technical Manuals for sale. Greetings I am currently selling Military Technical manuals. These manuals were specifically made with the intent to train soldiers on how to manufacture Explosives and Ignition systems behind enemy lines with normal everyday items. The difference between these manuals is the depth and specificity with which each one covers explosives. Either way, these are the actual texts not copies stapled together. They are each at least 100+ pages in length. Here they are including the asking price... There are in-depth designs of manufacturing pistols, rifles and recoilless rocket launchers from scratch. Also there are timed delays for explosives, the in-depth manufacture of napalm, other flammable gels and detonators and, all types of explosives”. This is a proof that he is involved in terrorism activities at least by selling the information that could help people make bombs and, other destructive devices. Opinion My opinion in this case is that Clyde Barrow was involved in the fraud. The evidence that we gathered and the one we have presented in this court clearly indicates that Clyde Barrow prints counterfeit money. This was shown by the images that we got both from his computer and his hard drive. They displayed images of one hundred dollar bills which the plaintiff was printing. To further add on that when we analyzed his printer we saw the images of the dollar on the printer. This is an indication that the printer was being used to print this fake money and that he was using this money, either by giving it to unsuspecting individuals or he was selling it to other individuals. In regards to whether Clyde Barrow and Bonnie Parker knew about each other, we found out that they did not only know about each other, they were in constant communication. It seemed also they were business partners. This was indicated by the two e-mails which we found in Clyde Barrow’s hard drive. The e-mails, one was sent by Clyde Barrow and the other one had been sent by Bonnie Parker. This was a clear indication that these two individuals were in constant communication with one another. Statement of Truth The report has been prepared in accordance with the Code of Guidance on Expert Evidence. 1. I understand that my overriding duty is to the court, both in preparing reports and in giving oral evidence. I have complied and will continue to comply with that duty. 2. I have set out in my report what I understand from those instructing me to be the questions in respect of which my opinion as an expert is required. 3. I have done my best, in preparing this report, to be accurate and complete. I have mentioned all matters which I regard as relevant to the opinions I have expressed. All of the matters on which I have expressed an opinion lie within my field of expertise. 4. I have drawn to the attention of the court all matters, of which I am aware, which might adversely affect my opinion. 5. Wherever I have no personal knowledge, I have indicated the source of factual information. 6. I have not included anything in this report which has been suggested to me by anyone, including the lawyers instructing me, without forming my own independent view of the matter. 7. Where, in my view, there is a range of reasonable opinion, I have indicated the extent of that range in the report. 8. At the time of signing the report I consider it to be complete and accurate. I will notify those instructing me if, for any reason, I subsequently consider that the report requires any correction or qualification. 9. I understand that this report will be the evidence that I will give under oath, subject to any correction or qualification I may make before swearing to its veracity. 10. I have attached to this report a statement setting out the substance of all facts and instructions given to me which are material to the opinions expressed in this report or upon which those opinions are based. STATEMENT OF TRUTH I confirm that insofar as the facts stated in my report are within my own knowledge I have made clear which they are and I believe them to be true, and the opinions I have expressed represent my true and complete professional opinion. Signature: Date: References: CITATION DBa10 \l 2057 : , (Kipper, 2010), CITATION NBe09 \l 2057 : , (Beebe, 2009), CITATION DBr02 \l 2057 : , (Killalea, 2002), CITATION RMe09 \l 2057 : , (Meadows, 2009), CITATION MTP09 \l 2057 : , (Pereira, 2009), CITATION AJu07 \l 2057 : , (Kaliski., 2007), CITATION ECC09 \l 2057 : , (EC-Council, 2009), Kiery F. Terrence, 2005, Forensic Evidence: Science and the Criminal Law, Second Edition, Taylor and Francis. Blackledge Roberts, 2008, Forensic Analysis on the Cutting Edge: New Methods for Trace Evidence Analysis. John Wiley & Sons. Shelton Donald, 2010, Forensic Science in Court: Challenges in the Twenty First Century. Rodman & Littlefield Publishers Shaffer Frank., 2008, Spectrum Science: Grade 8, 105-116. Tilstone William, Kathleen Anne Savage, Leigh A. Clark, 2006, Forensic Science: An Encyclopedia of History, Methods, and Techniques. ABC-CLIO, 307-326. Hails Judy, 2011, Criminal Evidence. Cengage Learning. Romero Libby, 2006, Forensic Chemistry. Benchmark Education Company Appendices: Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 From recycle bin MD5: FA51C478EEEB38E0EE5E75EE0D91537D SHA1: 2F4202FB1737E193CE7E4990821229AA88D045CD Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398 MD5: C3324BCF474B0D1BB5F33A69376AD877 SHA1: 8042F4D3C7E5D35F785700F2E283650D3F4EB634 Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004 From recycle bin MD5: E32DE369E6957A2996818A24768258EF SHA1: 727F41D81226BDDF8046C255CE68DD1B25682D88 Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 From recycle bin MD5: F7456BA98A0EE40A7F94E552D3B72028 SHA1: 2F6AAD7BED444D6437BA2B1C22A7EE00BD3A4CA8 Not Legal Tender Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 Form recycle bin MD5: D42B206A9A4E88D4AEB85BE8EAA283CE SHA1: 272B9466BF473C6E81338F2BC6ADFA2553E64804 From recycle bin Found: RECYCLER\S-1-5-21-1708537768-492894223-854245398-1004\Dc6 MD5: AA2B8526F3601A6E900BC69C7FB318C3 SHA1: 97D10F788BA4A9A26F0D10C285A459C55140EF79 Read More