Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Oct 6, 2003

“Texas? You want me to fly to Texas?” I chimed into my cell phone. “It’s frick’in humid in Texas!!”

I had been called in the late afternoon on a Friday by a ‘friend of a friend’ – industry talk for a confidential referral that involved a large retainer fee. The case was hush-hush, and nobody was giving any details.

I hopped the next available plane to Texas, which happened to be at 0400 hours.

“Nice.” I whined to myself, not looking forward to the body cavity search at the airport security checkpoint.

Before I knew it, the pain of the cavity search had subsided and I was wheeling a rental car down a Texas freeway headed toward Mechanical Inc.’s headquarters building… The building was a large high-rise covered in glass panels, and came conveniently with Valet parking.

“Try not to scratch it.” I joked to the Valet as I tossed him the keys to the rental.

Apparently someone had warned the receptionist in the building to be on the lookout for a chimp-like human that had an appointment with the C-level executives. I was rushed into an elevator and tens of stories later I was escorted by plain-clothes security guards into a lavish boardroom, complete with a wetbar and two pots of fresh, hot coffee.

“Jamaican Beans!” I exclaimed as I inhaled the mighty putrid aroma eminating from the pots.

“You know your coffee.” said a voice from behind the large mahogany conference room table. “But do you know anything about finding a needle in a haystack?”

“You could say that.” I replied, remembering the last time I searched for a shred of compassion while waiting in line at the Motor Vehicles Division.

“Chief, my name is Samuel Johanson. I am the CEO of Mechanical. To my right is our CIO, Michael Dickens, and to my left is Terry Gaim, Corporate General Counsel.”

Nods were exchanged around the room.

“So,” I began. “What’s the needle, and where’s your haystack?”

“I can answer that.” Terry announced after removing her glasses and letting them drape around her neck from a bright blue cord.

“Three months ago during a Corporate Compliance Audit, we discovered that our CFO at the time, Janice Wheatherly, was moonlighting as a financial advisor for a subsidiary of one of our competitors - NutsAndBolts, Inc. We confronted Janice about it, and she denied any involvement with the company. Our sources indicated that Janice was collecting fees from NAB, and was attending meetings at restaurants with NAB executives until the early hours of the morning. Corporate Security followed Janice and validated the information. We terminated Janice the very next day.”

“And the needle?” I begged.

“Ah, yes. Our human resources department and corporate security department had a miscommunication, and Janice was able to reenter the building, copy files to her laptop, burn them to CD, clean the laptop and then leave the building with the CD media before we knew what was going on.” Terry said.

“Ok, so I have to ask. How do you know that she burned files to CD media?” I asked.

Michael shuffled in his seat and said “All of our executive offices are monitored by CCTV (closed circuit television). We played the tape back and observed Janice placing CDR media into her laptop. Data Security has already confirmed that her network account accessed very sensitive files on the network at that time.”

“So you want me to prove that the files were actually copied to CDR media, thus substantiating your claim that she removed confidential records from the company after being terminated.” I deduced.

“Bingo.” Samuel said. “Our Data Security guys have been all over her laptop, and they can’t find any proof.”

“Samuel, do you have a lot of those Jamaican coffee beans?” I asked.

“Uh, sure?” he replied.

“I’ll need another pot of coffee and someone to show me Janice’s office.” I demanded.

Needle hunting is hard work.

Source: archived original

Part II · Oct 8, 2003

“I love efficiency!” I announced as I examined the accumulated digital evidence that Mechanical’s Data Security department provided me. They had really done their homework all the way around.

Bill, the Chief Investigator , had provided me with an enCase image of Janice’s laptop drive, a listing of all directories and files (with attributes preserved) on the file server that Janice supposedly accessed, and a copy of the digital video from the CCTV system.

“Bill, you’re telling me that your team has gone over this image with a fine tooth comb and there’s no trail to the CD burning?” I asked.

“Yep, the trail ran cold during the last examination of the enCase image. We have enough evidence through the usual places in the windows file system to prove that she logged in and copied some files around, but nothing that proves that she burned the files to a CDR.” Bill said, taking an almost embarrassed tone with me.

Bill left me to my work in a very comfortable office on the executive floor. I cracked my knuckles and turned Roscoe (my portable forensic workstation) on. Roscoe booted up rather swiftly, almost like he was eager to get on with the investigation…For nearly twenty hours I combed the contents of Janice’s hard drive in the enCase image. I was looking so hard for that needle that my vision was becoming a little blurry - although that could have been from the instant coffee that I was forced to drink a few times thanks to the coffee room auto-locking at 2000 hours. That’s a crime in itself.

I was beat. I was spent. I wasn’t finding anything. The CD burner software was there, and the FAT32 partition of this Windows 2000 laptop wasn’t telling me anything.

One of the duties of a forensic investigator is to be completely impartial through all investigations, and my gut was telling me that the needle didn’t exist.

“Too bad I’m not looking for a spoon. Maybe Keanu Reeves could help me out.” I mused, having a flashback from The Matrix.

The C-level executives were expecting a briefing tomorrow morning, and I had a feeling I wasn’t going to give them the answer that they wanted.

SecurityMonkey was out of clue bananas - and at a most inopportune time.

Source: archived original

Conclusion · Oct 10, 2003

The morning came fast. I had barely cracked open an eye in my hotel room when I noticed that I was going to be late for my meeting with Mechanical’s executive team unless I skipped one part of my morning routine.

I chose shaving. I certainly wasn’t going to be missing my cup of coffee at the nearby Starbucks. Pashaw.

I made record time in traffic, and appeared in front of Mechanical’s receptionist with two minutes to spare.

Plainclothes security escorted me again into the elevator. It was like being a movie star, only without the movies, the money or the star status.

I couldn’t stop thinking about my investigation, about Janice, and about the briefing I was about to give the Mechanical team. The CCTV clearly showed Janice inserting what appeared to be a blank CD-R into her laptop - but I had to PROVE that she transferred files onto the CD-R. By the results of my findings, I could not tell them that Janice burned the files onto a CD-R.

And then suddenly, it hit me… Years of working with linux and command-line CD-burning software flashed before my eyes as an idea smashed its way into my cranial cavity.

I apologized to the Corporate Security personnel and asked if I could return to the reception level. I then informed the receptionist that my meeting would need to be delayed until after lunch time.

I quickly drove back to my hotel, whipped Roscoe out from the trunk and entered my room. After a few minutes, Roscoe was up and running and I was examining the file system of the laptop one more time.

What was I looking for? Application swap. Almost all CD-burning applications write the destination CD image to a swap image (most of these are ISO files) before burning to a CD-R to prevent problems with the burn. I had looked the application directory and subdirectories up and down, but hadn’t found anything interesting - but we’re talking Windows here. Time to bet some money that the application developer had decided to use the system ’temp’ directory. Most of the time, I’d be looking in C:\WINDOWS\TEMP, however the laptop image notes that Mechanical’s Data Security folks had given me showed that the system temporary directory was set to C:\TMP.

Glancing through C:\TMP, there were lots of files - and a quick sort by date showed me three files that still retained the mystery date that Janice had supposedly burned the CD-R. I had seen these files before during my intial investigations, but I couldn’t make sense of the file structure - it looked like one large binary file.

Taking a gamble, I exported the file from the image and burned it onto a CDR. Throwing the CD-R into my linux laptop, I mounted the file using the loopback device to /mnt/image. My pulse quickened as I changed into the /mnt/image directory and issued the standard ’ls -la’ command.

Paydirt.

The ‘binary file’ was actually an ISO image that was created by the application shortly before the burn process. All of the filenames and filesizes that Mechanical had provided me matched the directory listing to a proverbial ’ T ‘.

My meeting with the Mechanical management team was going to be quite different than initially anticipated.

Management team mangled by clue banana. News at 11.

Source: archived original