Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Mar 27, 2006

Welcome everyone to “Case Of The Lascivious Lawyer”. This story was written by one of my most loyal readers - ChimpGal (she goes by another name when posting comments, but I’m not saying anything!). The names / dates / places have been changed in this story. I’m sure you’re all used to that by now.

I hope that as you read through ChimpGal’s story, you’ll think about submitting your own. You don’t have to use a style similar to mine (like ChimpGal did). Just write your story down and send it to me (chiefmonkey AT gmail.com). Go on, you know you want to!

Without any further delay, here’s Part I:

Case Of The Lascivious Lawyer - Part I [Written by ChimpGal - Edited by SecurityMonkey]

I knocked carefully at the door of the Chief Legal Officer. I didn’t like the rareified air up here on the 16th floor very much.

“You called me?” I asked.

“Thanks for coming, ChimpGal. Come in, and close the door.”

After a few pleasantries, we got down to business.

“ChimpGal, I want you to conduct an investigation of the head of Internal Audit and Clark Jones. We have reason to believe that there is an ongoing inappropriate relationship between them, and in some cases, company funds have been used to pay for rendezvous trips, dinners out, and so on.”

My little chimp brows disappeared into my hairline and my stomach lurched. Clark Jones was the legal representative for my department. The head of Internal Audit, Amy McAllen, was my co-equal. Both of us reported to the Board of Directors. One word from Amy to the board and I could find myself with no job and no way to support my growing Starbucks habit. Besides, I’d known Clark for years! Heck, I’d known Clark since he came to the company straight out of law school. I knew his wife and kids. I looked at the CLO as if he had sprouted a second head.

“You can’t be serious. Clark?? Okay, I’ll investigate but I’ll tell you right now that I don’t think I’ll find anything. And, by the way… I need the request in writing.” I backed slowly out of the office, still hoping to wake up from this bad dream.

Back in the monkey house, I went through the formalities of opening a case. I assigned it a formal case number, fetched a neon orange file folder, put the case number on the tab, and stapled a “Case Folder Contents” checklist to the inside front cover. The printed request for investigation, signed by the CLO, was checked off and placed in the folder.

Awww, monkey poo!! What was I going to do with this folder? I couldn’t put it into the department’s safe – Amy had a key and the combination to the safe as an Internal Audit safeguard. And what was I going to do with this case? I couldn’t very well assign one of the chimplets to investigate. Guess I’d have to do this one myself.

Well, I’d just have to ponder this one over a venti Americana….

39523-060327-312370-10 Rate content: https://web.archive.org/web/20140910134121/http://esbn.org/esbn/verify.asp?id=3952306032731237010&rate=yeshttps://web.archive.org/web/20140910134121/http://esbn.org/esbn/verify.asp?id=3952306032731237010&rate=no

Source: archived original

Part II · Mar 28, 2006

Case Of The Lascivious Lawyer - Part II Written by ChimpGal - Edited by SecurityMonkey

Our story continues!

I settled down on the patio of Starbucks with my precious brew, lit a cigarette, and took out my notepad to begin planning my investigation. This one would definitely have to be done in stealth mode. My scribbles read..** – Email messages – Blackberries – Disk images (web mail, IM logs, etc.) – Encase (what keywords?) **

The precious folder would have to go into my safety deposit box at the bank when it wasn’t in my hot little chimp paws. First things first, though – a few administrative details to take care of. I called John, the manager of the email team.

“John, this is ChimpGal. I have a request of the utmost confidential nature. This is one you cannot delegate – you have to do it yourself. I need the mailboxes of Amy MacAllen and Clark Jones dumped from both the regular mail server AND the Blackberry server. Keep them in 4 separate files, please – one for each account on the regular mail server, and one for each account on the Blackberry server. Burn them to DVDs, if you would, and I’ll pick them up in an hour.”

Four hours later, both my brain and my monkey butt were numb, and I was nearly blind from slogging through the messages on the regular accounts. Nothing!!

I moved on to Clark’s Blackberry file.

Five minutes into my search, my heart sank. Although not a smoking gun, the first message I found was certainly suggestive.

**From: [email protected] To: [email protected] So are you “up” for a visit from me? I’ll “come” over 2 where u r … ;-)

Sent from my BlackBerry Wireless handheld———- **

I sighed and clicked “Print” to send the image to the confidential printer on my desk. It was going to be a lonnnnnng night.

Two hours later, I sat back, rubbed my eyeballs, and looked at the inch-thick stack of printouts from the Blackberry messages. Some of the messages had gotten pretty steamy, but none of them were proof of impropriety. I stapled the pages together and dumped them in the case folder.

Having found nothing conclusive on the Blackberry server, but lots of (ahem) suggestive communication, I turned my attention to the Microsoft Exchange mail servers.

I made a note in the case file of the time and date that I accessed both accounts, then dumped both accounts to PST files. PST files were mail archive files that could be viewed by Microsoft’s most popular mail client, Outlook. I had learned the hard way as a young investigator to review email from a PST rather than the live server database, in order to avoid tipping off the subject that they were under investigation. Having the PST files on CD also enabled me to take the data home with me, for perusal in those wee morning hours when sleep eluded me because of too many Venti Americanas too late in the day.

Hours passed as I slogged through literally thousands of messages.

Nothing.

I was hungry and I needed a cigarette, but if I was going to examine their hard drives, after hours was the time to grab the images. I clicked over to my Active Directory tool and looked up their accounts, then flipped over to SMS to find the names of the machines last used by those accounts.

Bingo!

I clicked “Print” and added the pages to the case folder.

_ (Note to the reader… the three most important words in every investigation are DOCUMENT, DOCUMENT, DOCUMENT! ~ ChimpGal)_

Case folder in hand, I grabbed a FireWire drive and my Encase token and headed for the forensics lab. I started up Encase Enterprise, inserted my token, and started the drive imaging.

A few hours from now, byte-for-byte images of both drives would be on my FireWire drive. Right now, though, I was headed for a cigarette and my nearest Pizza Trough for their pizza buffet.

56600-060328-973732-76 Rate content: https://web.archive.org/web/20140910153917/http://esbn.org/esbn/verify.asp?id=5660006032897373276&rate=yeshttps://web.archive.org/web/20140910153917/http://esbn.org/esbn/verify.asp?id=5660006032897373276&rate=no

Source: archived original

Conclusion · Mar 30, 2006

(Burp!)

Ahhh. Nothing like pigging out at the local Pizza Trough. I stopped by the nearest StarBucks for a venti Americano and an espresso doppio to go. It was going to be a loooooooooong night and I was going to need brain juice. Returning to the office, I badged into the forensics lab and logged into the examiner workstation that was creating the hard drive images.

Aha! The imaging was done.

I specified an e-mail search (just in case they were smart enough to use AOL, Yahoo! or Hotmail) as well as Internet and keyword searches and launched them. Once the searches were complete, I began the tedious task of slogging through the search hits to find the golden nuggets of evidence.

It didn’t take long until I came across an incredibly sexually explicit IM session between the two of them.

I clicked “Add to Report.”

Wiping the steam from my glasses, I slogged on. A few mouse clicks later, I had the smoking gun….

**From: FlirtyAudit @ hotmail.com Sent: 14 Oct 2004 To: SexyLawyer2374 @ hotmail.com Hi handsome… here’s the reservation for the resort. “Officially” it’s a retreat for our senior auditors to plan our strategy for conducting Sarbanes-Oxley audits for the coming year… and of course we need legal advice.

heh heh heh.

At least that’s what im telling my husband and you can tell ur wife and i am planning on putting on the expense rpt. They don’t need to know the auditors will be there only for about 3 hours, and the rest of the 3 days we’ll have to ourselves.

I can’t wait… I’m getting all bothered just thinking about what i am going to do to you… i’m going to (censored censored censored*)

Amy**

Attached to the e-mail was an e-reservation for a $2000 / day resort and spa. I clicked “Add to report” for both the email and the reservation and moved on, looking for the expense report that had been filed after Amy’s return. Yup – got it.

I added that to the report as well.

I printed 2 copies of the report, one for the case file and one for the Chief Legal Officer. As I badged out of the lab, not even the gorgeous pink sunrise could lift my spirits.

I was heartsick.

A few days later, Amy was summoned to an “emergency” Board of Directors meeting. As soon as she was seated, the Chairman handed her a copy of my report. I knew when she reached the page containing the reservation and its attendant e-mail, because suddenly all the color drained from her face and tears welled in her eyes.

“You have a choice, Amy. Right now, as we speak, the head of HR and the head of physical security are escorting Clark out of the building. He tendered his resignation 15 minutes ago. In front of you is your letter of resignation. Sign it, and we won’t prosecute. Fight it, and we drag you, Clark, your children, his children, and everyone who knew about your affair through the mud. Now, which would be better for you?”

Wordlessly, Amy uncapped her Mont Blanc pen….

[Note from the Chief: A HUGE thank you to ChimpGal for a very entertaining read! Okay monkeys, submit your case files! I want to hear from you. Chiefmonkey AT gmail.com]

22733-060330-144463-93 Rate content: https://web.archive.org/web/20140910144710/http://esbn.org/esbn/verify.asp?id=2273306033014446393&rate=yeshttps://web.archive.org/web/20140910144710/http://esbn.org/esbn/verify.asp?id=2273306033014446393&rate=no

© 2006 All Rights Reserved.

Source: archived original