Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Dec 22, 2003

I never know what my next assignment will be. One minute I’m up to my armpits in child pr0n distributors, the next minute I’m catching an overpaid executive selling company secrets… and before you know it I’m low on coffee and grumpy as hell.

And so our next case begins… with me being low on coffee and really grumpy.

The night before ended as the sun came up - only problem was that I had never made it to bed. I was staring blankly into an LCD display, watching my copy of Autopsy scroll through an imaged hard drive. The owner of the original hard drive had his web server hacked, and I was digging out dirt from between the fingernails of the linux filesystem.

ring

Hearing my cell phone ring at 0700 hours is like asking a 300 lb linebacker to smash my head into my desk a few times before he slams me to the ground in a piledriver move. Yeah, it’s no fun.

“Chief” I croaked into the phone.

“Um, yeah - I was given your number by a Ted. He said you do computer investigation work?” the female voice asked over the phone.

“Maybe - who’s asking?” I replied.

“My name is Donna - and I - well - I think my husband is cheating on me. He stays on our phone all night with some woman. He always has a zillion chat windows open on our computer and never tells me who he’s talking to… I just don’t know what to do and Ted told me…” Donna sputtered off into the distance.

“Okay, okay. Let’s meet for lunch.” I suggested.

A quick smell of my shirt told me I needed to shower - and find last night’s coffee cup. I’m sure I had some dark roast in there… might have to microwave it….We met at a local sandwich shop known for their incredible bread and homemade orange soda. I wasn’t into orange soda, but I saw a fresh pot of joe coming off the brewer and I was twenty minutes into a caffeine withdrawal that would kill Keith Richards.

“Thanks for meeting me Chief.” Donna said as I shook her hand.

“Ok, so here’s the deal.” I started. “If you suspect he’s using the computer to arrange these dates and carry out illicit conversations, then I’ll need access to the computer when he’s not there. I need about an hour or two to enter the home, image the hard drive and put things back the way I found them.” I said in between bites of a wonderful turkey and swiss on sourdough.

“Well, it shouldn’t be a problem - he leaves at 0730 every weekday and returns around 1800. I work the same hours though, so I’ll just give you a key.” Donna said as she reached into her purse.

‘That works - and if you have any pets - like large blood-thirsty dogs, please put them in the backyard." I joked, remembering the three pairs of pants I had lost to man’s best friend.

“Not a problem.” Donna said as she handed me a key to her home and an envelope with my retainer.

This case was sure to be a no-brainer, and an easy way to pump up the “Chief’s Coffee Plantation” savings account.

The next morning came quickly, and I was already pumped to slam-dunk this case and move on to other business. I threw Rosco (remember Rosco?) in the trunk of the car and headed out.

I arrived at Donna’s house around 0930 hours. The place was quiet - no neighbors around - no dogs barking. Excellent - just the way I like it.

I parked two houses down, removed Rosco from the trunk and headed to the front door.

A minute later, I was in the home and was careful to lock the door behind me.

I walked down the hall into Donna’s den, and spied the Compaq workstation on the desk, powered on and booted into a Windows 98 desktop. Joy.

Removing my digital camera from my equipment bag, I snapped several photos of the room to insure that I put everything back the way I found it.

I approached the desk and looked at the Windows 98 desktop. No applications were running. Good.

I pulled the workstation out from under the desk a few feet until I had visual contact with the cables running into the back of the computer. I snapped a few more photos.

After writing down a few observations of the room, I grasped the power cord and gave it a quick yank. The machine was quiet in a matter of seconds.

Using my trusty electric screwdriver, I had the case of the computer off in a matter of a minute or two.

I opened Rosco’s case and powered him on. Time to image this bad boy.

I was in the process of disconnecting the primary IDE cable from the hard drive in the workstation when my cell phone vibrated.

“Chief.” I whispered into the phone.

“CHIEF! IT’S DONNA! MY HUSBAND ISN’T AT WORK! I THINK HE’S ON HIS WAY HOME!” Donna screamed into my ear canal.

Her words had barely penetrated my cranial cavity when I heard a car pull up into the driveway of the home.

Now would be a great time to panic.

Source: archived original

Part II · Jan 2, 2004

If one must do investigative work, one must learn to mentally track each and every step that one does and be able to work in reverse very quickly.

The sound of the car pulling into the driveway was still fresh in my ears. I had to make some quick decisions.

I quickly placed the case back on the workstation (sans screws), inserted the power cord, and pushed the workstation back into place. I hit the ‘power’ button on the front of the machine and listened for the power supply fan to come on.

Within microseconds I had Rosco closed and slung over my shoulder - I needed to find a secondary exit to this house.

As I rounded the kitchen counter and placed my hand on the back door knob a familiar voice rang through the house.

“Chief! Chief! Let’s go! You need to get out here now!“It was my client. Perhaps I had hung up on her too fast in my panic - looks like she raced home to play interference if necessary.

No matter - I was already exiting through the backdoor of the house and heading for the gate.

Less than a minute later I was seated in my car sharing a cold aluminum-colored mug of coffee with Rosco. My eyes were transfixed on my client’s house - for the first time I was going to see Donna’s husband.

I was two sips away from the bottom of my french roast when a red pickup truck pulled in front of the house. A large Pacific-Islander-looking type exited the vehicle and headed towards the house.

Time to return home and wait for Donna to contact me again - and change my shorts.

(Aside)

Will Donna’s husband notice that his workstation doesn’t have any screws holding the case on?

How will I successfully image the harddrive? Same plan, different time?

What am I going to tell Donna so this doesn’t happen on my next attempt?

(/Aside)

Source: archived original

Part III · Jan 12, 2004

Gulp.

I crave excitement like the next guy, but the thought of a big burly Pacific-Islander-Linebacker-type finding me in his den tearing his computer apart is just frightening. What if he threw me through a window? What if he had a gun? WHAT IF HE SPILLED MY COFFEE!

shudder

I grabbed a bite to eat on the way home and then hurried into my home office. I hadn’t been sitting down for more than thirty seconds when my cell phone rang.

“Chief” I said between a burp and a hiccup, giving me a unique “Pee-Wee Herman” sound.

“Chief?” Donna’s voice said on the other end of the phone.

“That’s what I said!” I replied.

“Chief, I am SO sorry about that. My husband called me when he was halfway home from work to tell me that he was taking the rest of the day off to go play golf. I called as soon as I could!” she exclaimed.

“Lucky for you I have these cat-like reflexes!” I joked. “But seriously, I need access to that machine. I need you to escort your husband out someplace and keep him occupied for at least an hour. The hard drive in that machine looked pretty small - Windows reported 4GB of total storage space. Shouldn’t take long.”

“Ok - look - he’s going to be at the country club after his golf game today… you want to try tonight? I’ll go meet him up at the club and keep him occupied.”

“Works for me.” I said as I ended the conversation.1900 hours and I’m in Mission Impossible mode. I’m parked outside of Donna’s house, waiting for the “all clear” cell phone call.

A few minutes later, my cell phone rang. It was Donna - and everything was going to plan. I had about 90 minutes until they’d be home.

I sprang from my car and sprinted through the side gate and entered the house through the laundry room door. I sprinted into the den and started my imaging procedure again.

I took pictures of the area with my digital camera.

I wrote some notes on the type of hardware and data/voice connections I saw.

The computer was on and still booted into Windows. I carefully pulled the computer forward so that I had access to the back of the case.

I yanked the power cord and heard the power supply fan die a slow death.

I gripped both sides of the case and gave a slight push to wedge the case off of the machine.

Won’t budge.

WTH, over.

There were screws in the back of the case.

Whoops - looks like somebody noticed I was there.

The rules of the game had suddenly changed. I extracted the screws, slid the case off and began the imaging procedure with Rosco.

Encase was tearing through the drive at an impressive speed. As the imaging proceeded, I nervously walked around the room. Something didn’t feel right… something familiar… like I was being watched.

I began thumbing through the books on the desk and in the bookcase. I sat down on the floor near the computer and started thumbing through my notes.

Encase finished the image in record time. I packed Rosco up, and proceeded to put the computer case back together. As I powered the machine back on I heard a low, gurgling noise. Thinking I had an IDE cable dangling in the machine and possibly touching a CPU fan I started to unscrew the case again.

I heard the noise again and turned to my left.

I was being watched by a 150 pound Great Dane.

Nice Doggy.

gulp

Source: archived original

Part IV · Feb 1, 2004

“Nice doggy” I whispered. Where did this dog come from, and how did he get in the house? Or was he in the house the whole time?

I walked slowly towards the dog, grinning ear to ear in the hope that he wouldn’t eat me. The dog wasn’t the least bit interested in me, placed his head between his front two paws and went to sleep.

A quick walk to the rear of the house showed that the dog had been asleep in a bedroom and walked out to greet me. “The client is going to get an earful from me!!!” I said under my breath.

I collected my sanity, packed my gear, put the computer back together (including the screws) and booted the machine back into Windows.

Exit, stage left.Back at my home office, I brewed a nice pot of Starbucks coffee and began the evidence inspection routine. I carefully read over my notes to make sure that they were complete. I made a quick copy of my evidence drive (the encase image) and placed the evidence drive back into it’s static bag and marked the date/time on the bag. “Gotta cross my T’s” I thought to myself.

I placed the copy of the evidence drive (my “working copy”) in my evidence analysis machine (which is basically a Windows 2000 professional workstation with Encase/Forensic Toolkit [FTK] installed) as a slave drive and proceeded to work through the Encase image.

I did a quick “pre-scan” of the drive using FTK to try and guage the computer savvyness of the user. I spotted a lot of random files in the root directory of the C:, and the users desktop folder was a complete mess of images, documents, icons, etc. One would have to make an assumption that this user is either savvy and lazy, or a relative ’n00b’ user that doesn’t bother to keep his personal files organized.

After a page of notes on the user (the user “profile”) I proceeded to use a keyword list provided to me by my client. This list included possible names, locations, objects and other words that might help me locate information relating to the client’s husband cheating on her.

FTK rocked through the data on the disk at an amazing speed. FTK builds a database of sorts that enables an investigator to quickly search through gigabytes of data by keyword search, file type, etc.

However, the word list turned up nothing.

“Unusual” I thought. Nine out of ten investigations, the word list almost always helps the investigator narrow their search. Hmmm.

I proceeded to examine all of the picture images on the disk. Nothing exciting there. Internet Explorer URL history files turned up nothing unusual - wait - this guy doesn’t use e-mail? No yahoo, hotmail, msn, aol…. as a matter of fact, I couldn’t find any of the typical traces of webmail on the system. There were no e-mail clients installed either, except Outlook Express - which wasn’t configured. A quick check of the drive for OE mail files turned up nothing. What the hell!

Am I to believe that this user uses this computer to play a few games, go to a few websites here and there… and nothing else? This wasn’t adding up. I missed something.

I started walking the “Program Files” application tree again and stopped cold in my tracks.

Citrix Metaframe Client.

Cripes.

Source: archived original

Part V · Feb 9, 2004

SLAM SLAM SLAM SLAM. Yes, that was me slamming my head into my desk. Looks like the hubby dials into a network somewhere and uses a Citrix Metaframe Client to run applications on a remote server…

My client didn’t have broadband, so I immediately looked at the dial-up properties of the workstation. Tah-dah! A Globelink account (typical ISP) and one marked “Work”.

SLAM SLAM SLAM SLAM. My head hit the desk.

How did I miss that on my first pass? Easy - I made a boo-boo as a forensic investigator. I went head-strong into assuming that the user was conducting business on their local machine, and that the user wasn’t very savvy at using the computer judging from the condition of the hard drive.

My next mission was to image the Encase image back onto a hard drive, boot the drive and play.

I keep a standard “clone” PC machine in my office for just such a purpose. I inserted the freshly-written hard drive into the clone box and booted the machine.

After a few typical errors from Windows (can’t find this device, blah blah) I was at a Windows 98 desktop. I examined the dial-up properties of the “Work” dial-up networking icon. DING! Paydirt.

It was configured with a phone number, username and password.

I documented my findings, and grabbed my cellphone.

Time to call the client. I wasn’t going to be much help to her at this point.

(Aside) Why? Anyone? (/Aside)

Source: archived original

Part VI · Feb 20, 2004

This was not the first time that I had hit a brick wall in an investigation. I couldn’t very well dial into the client’s husband’s work network and start poking around even though I had the necessary connection information. This is what I consider the “fine line” in an investigation - you can’t leave “the box”. Why? The client had authorized me to image and poke around in her machine - one that she had legal ownership of. The network that her husband had access to was a third-party network and the property of another entity - in this case, the husband’s employer. By connecting to the third-party network without prior consent from the employer, I could be guilty of a cyber “break and enter”. Not my cup of tea… err.. coffee, baby. A quick call to the client was made.

“Donna, it’s Chief.” I said.

“Hi Chief! What have you found?” she asked

I proceeded to describe the situation to her, and of course she was not very happy. She did something at this point that most clients do: she asked me if I could monitor her PC in someway that I could record her husband’s actions w/o connecting to the third-party network.

Sticky situation. Shooting from the hip, a course of action could include a keylogger or other type of “spy software” installed on the PC that would record and monitor what her husband was doing on the PC. However! I would potentially view information on a private third-party network - it’s the “chicken and the egg” scenerio all over again.

If you were the investigator working this case, what would YOU do at this point?

Remember that you can’t leave “the box”, and you can’t violate the third-party’s network security/privacy policy.

Discuss.

The reader that come closest to what I actually did scores points with the Chief. :-)

Source: archived original

Part VII · Mar 10, 2004

It was going to be a challenging day. A quick search through the Chief’s coffee cupboard revealed a tin of Folger’s, three packets of instant coffee from 1997 and a previously used tea bag. Tea bag - TEA? How did that get in MY cupboard? I proceeded to brew a fresh pot of Folgers and sat down in front of my forensic analysis workstation. The LCD started to look more and more like a brickwall.

But as any good case investigator will tell you, sometimes you have to be creative and inventive… but stay inside “the box”.

I poured a cup of the almost-coffee into my favorite mug (from my good friends at a certain agency - thanks guys!!!!), flipped through my notes and reached for my trusty cellphone.

Time to call Donna and introduce her to a friend of mine. A very interesting friend.Donna and I agreed to meet at a coffee shop (surprise) that was on the other side of town. We were just starting to chat and enjoy a wonderful Peruvian blend when a familiar Jeep pulled into the parking lot.

“Yo Chief - what’s new?” asked Jonathan. Jon was an expert in physical surveillance, and had logged over ten years with a certain government agency. I met Jon at a security conference several years ago. I had helped Jon on a few cases in the past, and now I was calling in a favor.

“Jon, this is our client Donna. I’ve briefed you on my investigation, and now I’d like you to present your ideas to Donna.” I said in between sips.

Without saying a word, Jon grabbed a duffel bag that he brought with him and sat it on the chair next to Donna. He placed on the table several devices that included a wireless pinhole camera, an audio transmitter, a custom-built audio/video receiver/monitor, and perhaps the smallest VCR I had ever seen.

“Donna, what I’m proposing is a step beyond what the Chief here has done. Computer forensics has run it’s course, and now the Chief and I agree that we need to do some old-fashioned P.I. work.” Jon said with a grin.

“Oh my. This sounds expensive.” Donna joked.

Jon stared at Donna.

Jon blinked at me.

Jon stared at Donna.

“I’d like permission from you to install these devices in the bookcase located behind your husband’s desk. These devices are of a superior quality and have been modified by me for just this type of work. The battery life is just over two days - I will then need permission to re-enter your home and remove the devices. You may not touch, move or modify these devices in anyway or it could compromise my portion of this investigation. Clear?” Jon asked.

“Uh, sure Jon. If the Chief trusts you, you can’t be too bad.” Donna said with a grin.

The installation went without a hitch.

Two days had passed and Jon called me on my cell to tell me he was ready to grab the gear from the home. I was called away to a meeting with another client, so I asked Jon to call me again after he had grabbed the gear and performed a cursory analysis of the video/audio.

Later that evening as I was unwinding from my day, my cell rang.

“Chief.” I answered.

“Yo - I got the surveillance back. " Jon said proudly.

“And?” I asked.

“Looks like Donna’s husband is trying really hard to get a promotion - he’s putting in a lot of extra work.” Jon replied.

“Eh?” I asked. “He’s working on some big project?”

“Yeah.” Jon replied. “And it involves a lot of one-on-one time with his boss.”

“Typical. So what’s her name?” I queried.

“Thomas.” Jon shot back.

Oh my.

Source: archived original

Conclusion · Mar 17, 2004

Apparently my ability to forsee the future had become clouded.

A quick call to Donna, and we were back at the coffee shop the next day to discuss the summary of findings.

Once the summary of findings was discussed, Donna could ask us to continue surveillance, or pack sand. Either way would work for me at this point.

Donna sat down at the table, and nervously glanced at me. Jon was busy slamming down his second mocha latte (a trait that I really appreciate in him) and enjoying the ensuing caffeine buzz.

“Donna” I began, “Through our surveillance of your husband, we have found what we believe to be an extra-marital affair taking place.”

Donna begain to tear up. I continued…

“Through video and audio surveillance of your husband’s home office, we discovered that he was indeed logging into his company’s network via a Citrix Metaframe client and having discussions of a sexual nature with another person.” I said.

“Who is she?” Donna asked.

I glanced at Jon.

Jon glanced back.

I nudged Jon in the arm (gently).

“Donna, if you’ll look at these screen prints that I made from my video footage, you’ll see that your husband is involved in a discussion of a sexual nature with an individual named Thomas. Exhibits F and G show a screen capture of some emails with a person named “Thomas Ferrer”. Thomas Ferrer is your husband’s..”

“Boss.” Donna finished. She appeared to be in some sort of mental shock.

“Yes.” Jon replied. “The evidence collected from the surveillance speaks for itself. What you decide to do at this point is up to you.”

I held my head in my hands and watched Donna for any sign of emotion. She wasn’t taking this well.

“Chief, you’re telling me that my husband is having a sexual extra-marital affair with his boss, who happens to be a man?” Donna asked as she wiped a few tears from her eyes.

“Yes M’aam. That’s what we’re telling you.” I responded.

“Chief, Thomas has been to our house hundreds of times. We go to his kids’ baseball games. My husband and Thomas went…. to…. oh God!” Donna said as she hid her face in her hands.

“Your husband and Thomas traveled together?” I asked.

“Yes, all the time! They went white-water rafting, hunting, camping…” Donna trailed off again.

Donna stood up, adjusted her clothes and extended her right arm towards me.

“Thank you Chief, I need to go now.” Donna said as she shook my hand, turned towards Jon, gave a polite smile and walked to her car.

“I really hate this part of the job.” Jon said as he watched Donna drive away.

“Me too, Jon. Me too…” I whispered.

(Aside)

Around a month later, Donna was moved out of the home that she shared with her husband and moved in with her Mother. Donna filed for divorce, which was uncontested by her husband. Donna never revealed the fact that she hired investigators to find out about her husband’s extra-marital affair.

As proud as we (as investigators) are of our work, sometimes the results are hard to share with the client. Even for those of us with a coffee-induced iron gut.

Note: Thanks to reader “Mace” I realized that I left something out of this casefile. When I had to exit Donna’s house in a hurry I didn’t have time to put the case screws back in - yet on my second visit they were screwed in. How did that happen? I had told Donna on the phone after my hasty exit that I missed the screws. She apparently took it upon herself to screw them back in, but never told me until our last meeting.

(/Aside)

Source: archived original