TEAM B FORENSICS INVESTIGATION

Casey Jackman, Craig Marshall

Meet Carol

General Approach

General Disk Information OS User accounts Programs/Applications installed Discover relevant data Build Profile Timeline

Forensics Tools Used

AccessData FTK LiveView VM Ware Server Google/Maps Street View Whitepages.com Password Recovery Tool Kit (PRTK) Cain and Able (Password Cracking) Motobit.com AIF Decoder

1996

Creation date of First file on disk: various OLE streams

6/27/1996

Windows Install: Conclusion based on the creation dates of core OS files.

7/7/1997

Strange cartoon of naked woman is created on drive.

12/24/1997

Novell installed.10/14/1998

Softstuff screen saver installed.

1/6/1999

Pervasive SQL installed

5/17/1999

JAMESH account created. James

Hill(Systems Admin)

12/14/1999

Nada Car Guide installed12/14/1999

SHARONC account created. Sharon Child(Title Clerk)

12/20/1999

CAROLG account created. Carol Goldsberry(Construction Loans) 3/21/2000

MICHELLE account created.

4/12/2000

DAVEP account created. Dave

Purdon(Network Admin)

4/12/2000

UCCU starts new email

system 8/4/2000

Carol begins using outlook

express8/4/2000

Year 2000 audit report is received in an email

9/14/2000

UCCU begins new Authorization System10/2/2000

Carol accesses CNN.com3/19/2001

Carol access insideucc.com3/20/2001

Carol logs in for last time3/21/2001

Email is last accessed3/21/2001

Administrator account is created2/10/2003

Last email in outbox1/31/2001

Last email received1/12/2001

Goldsberry Christmas letter received1/21/2000

Last email sent12/18/2000

UCCU has Christmas party at Aspen Grove12/18/2000

KARENP account created. Karen Peterson 10/23/2000

Jim and Alise Wise Christmas letter received10/18/2000

1997

1998

1999

2002

2000

2003

2001

2004

System

Installations

Accounts

UCCU

Carol Goldsberry

Email

Drive Profile

OPERATION SYSTEM: Windows 95 ADMIN USERNAME: admin ADMIN PASSWORD: admin DRIVE SIZE: 1.5GB FIRST KNOWN OPERATION DATE:

6/27/1996 LAST KNOWN OPERATION DATE:

2/10/2003 SIGNIFICANT APPLICATION

INSTALLATIONS: Pervasive SQL, Nada Car Guide, Novell Client, Outlook Express

[Password Lists]

[PASSWORD LISTS] UCCU=C:\WINDOWS\UCCU.PWL JDW=C:\WINDOWS\JDW.PWL DENZILD=C:\WINDOWS\DENZILD.PWL JOSEPHW=C:\WINDOWS\JOSEPHW.PWL JOEW=C:\WINDOWS\JOEW.PWL CAROLG=C:\WINDOWS\CAROLG.PWL CONNIEH=C:\WINDOWS\CONNIEH.PWL LAROSEH=C:\WINDOWS\LAROSEH.PWL SAUNDRAG=C:\WINDOWS\SAUNDRAG.PWL JAMESH=C:\WINDOWS\JAMESH.PWL SHARONC=C:\WINDOWS\SHARONC.PWL MICHELLEM=C:\WINDOWS\MICHELLE.PWL DAVEP=C:\WINDOWS\DAVEP.PWL KARENP=C:\WINDOWS\KARENP.PWL  

Company Profile

COMPANY NAME: Utah Community Credit Union

COMPANY BRANCH: River Woods BRANCH PHONE NUMBER: (801)

223 7656 COMPANY DESCRIPTION: Credit

Union providing financial services and information

BRANCH ADDRESS: 188 W. River Park Drive Provo, UT 84603

UCCU Construction Loans

User Profile (Primary User) FULL NAME: Carol Goldsberry POSITION: Construction Loan

Specialist USERNAME: carolg EMAIL PASSWORD: carolg EMAIL ADDRESS: carolg@uccu.com WORK PHONE NUMBER: (801) 223

7625

Interesting Findings

Administrative User Password Carolg email settings and Password AIF Decode Corporate Directory Audit Report Monthly Technology Newsletter

VMWare Server

Email Information

Email

AIF Decode

Phone Directory

Technology News Letter

“If you haven't already taken the opportunity to test the new system, we urge you to do so before October 2. You can access it by enter BYUALT at the USERNAME prompt when logging into DataSafe. Enter TEMP0 (TEMP "zero") as the password. Your Teller number remains the same and your password is your last name. This is a test directory, so feel free to enter as many transactions as you would like to ensure that it will work for you when we go live. Report any problems to James Hill (ext. 462).”