Free Essay

Computer Forensics Analysis Project

In:

Submitted By klr2724
Words 799
Pages 4
Computer Forensics I (FOR 240-81A)
Project #3

Case Background
The Suni Munshani v. Signal Lake Venture Fund II, LP, et al suit is about email tampering, perjury, and fraud. On December 18, 2000, Suni Munshani (Plaintiff) filed a suit against Signal Lake Venture Fund. Mr. Munshani claimed that he was entitled to warrants in excess of $25 million dollars from Signal Lake. In February 2001, Signal Lake Venture Fund II, LP, et al. (Defendant) became privy to the court filings in this case. Within the filings there was an email provided by Mr. Munshani from Hemant Trivedi, CEO of one of the portfolio companies, stating he was indeed entitled to the warrants. Mr. Trivedi denied any knowledge of the email, or any such communication with Mr. Munshani. In an effort to prove their innocence, Signal Lake hired a computer forensic group to conduct a private investigation. The investigation did not show any evidence of the supposed email provided to the court by Mr. Munshani.
Mr. Trivedi filed an affidavit stating that the email was forged, while Mr. Munshani filed an affidavit stating the email was real. In March 2001, a computer forensics expert, Kenneth R. Shear, was appointed by the court to perform a forensic examination on the questioned message (the message provided by Mr. Munshani) and the comparative message (a second message from Mr. Trivedi found on Mr. Munshani’s computer). Mr. Shear worked for a company called Electronic Evidence Discovery, Inc. (EED).
Mr. Shear’s forensic analysis involved the examination of 33 drives of both Mr. Munshani and Mr. Trivedi. The drives included laptops, personal computers, tape disks, and SCSI backups. In addition, multiple CDROM’s were analyzed. The report was written in a format that explained complicated details so that a layman could understand. A variety of software and techniques were used in the imaging and evaluation of the drives. Duplicate “mirror” copies of the computer hard drives were performed using a computer program called Safeback, version 2.0. Once the images were restored to clean hard drives, a computer program called EnCase was used to search the restored drives. EED also used EnCase and proprietary utilities to search the hard drives of restored image copies performed by Deloitte and Touche. Mr. Shear’s report included a step-by-step analysis of the examinations performed.
Mr. Shear and his associates were able to determine that the questioned email message was downloaded from an email server onto Mr. Munshani’s laptop on August 3, 2000. On December 19, 2000, Mr. Munshani altered the email message and the contents of the email header. Mr. Shear noted that although Mr. Munshani knew what the header data need to reflect, but he did not understand what should have been changed. Mr. Shear also noted the following opinions: * The questioned email was copied from the comparative email. * There was an inconsistency between the message ID and the message time in the questioned email. * There was an inconsistency between the sent and received dates shown on the questioned email and the create and modified dates. * There was an absence of any record of the transmission of the questioned email in the email server logs for Signal Lake.
Mr. Shear took 7 months to complete his investigation, presenting his report in September 2001. His report totaled 147 pages and provided evidence that showed the questioned message was not authentic. Ultimately, Mr. Munshani was caught by the duplication process he used in which the questioned email contained the same ID number (known as an ESMTP ID) as in the comparative email. An ESMTP ID number is unique to a particular email and no two emails passing through the same server would have the same ESMTP ID number.
The Court ordered the case dismissed and Mr. Munshani to pay all the costs incurred by Signal Lake due to Mr. Munshani’s fraud, including the cost of Mr. Shear.

Lessons Learned:
There are multiple lessons to be learned from this case. 1. First, and foremost, don’t lie. 2. Archive your email. Have a retention policy in place. 3. Email is important and necessary to save. 4. Email can be dangerous, so use it cautiously. 5. That there are a multitude of tools and methods for evaluating data. 6. Analyze message headers and Outlook metadata. 7. Use key word searches during your forensic analysis.

References:
Shear, Kenneth. Report of Kenneth Shear. 12 September 2001.
<http://www.signallake.com/litigation/shear_report_munshani.pdf>.

Suni Munshani v. Signal Lake Venture Fund II, LP, et al. 1-7. No. 00-5529. Suffolk
County Superior Court. 9 October 2001.
<http://www.signallake.com/litigation/ma_order_munhshani.pdf>.

Weigarten, Michael and Adam Weingarten. Email Tampering - This Time, The Good
Guys Won. January 2002. Business Communications Review.
<http://www.signallake.com/litigation/emailtampering.pdf>.

Similar Documents

Free Essay

Security Job Search

... Title: Forensics Managing Specialist –Security JOB DESCRIPTION All Forensics Candidates are encouraged to apply. Jr. to Sr. level positions are available from 2 years to 10+ years experience. Salary based on experience. A Bachelor's Degree in Forensics or related is a plus. This is a full time perm position. Must be willing to travel nationwide. Our client’s computer forensics team is a comprehensive solution for global data collections and forensic analysis. They offer best-in-class security. From small to large matters, they provide easy to understand interpretations of findings and a single point of contact. The Managing Consultant utilizes state of the art techniques that enable the recovery and use of critical electronic evidence for litigation, investigations and other fact-finding exercises. The Computer Forensics Managing Consultant establishes whether evidence has been erased or modified; analyzes electronic content and patterns of Internet and e-mail usage; recovers deleted data; and assesses and explains metadata within recovered files. RESPONSIBILITIES Manage day to day activities for projects involving computer forensics, information security or rapid response data breach matters. Manage large data preservation and collection activities to ensure that accepted forensic protocols; create and maintain Chain of Custody; document the handling of evidence. Analyze log files from firewalls, web servers and computers. Conduct forensic analysis and write...

Words: 585 - Pages: 3

Free Essay

Mobile Forensics in Healthcare

...2009 Eighth International Conference on Mobile Business Mobile Forensics in Healthcare Connie Justice, Huanmei Wu Computer & Information Technology Purdue School of Engineering and Technology Indiana University Purdue University Indianapolis 799 W. Michigan St., ET 301 Indianapolis, IN 46202 {cjustice, hw9}@iupui.edu Abstract -- Mobile communication has been heavily applied in the current healthcare system for health information exchange. Patient information security has become a major concern, especially with the wide adoption of electronic medical records. Mobile Forensics has been utilized by law enforcement to systematically procure and preserve mobile evidence. However, the adoption of mobile forensics in the healthcare lags behind. The goal of our project is to examine the options and to provide recommendations for adoption and customization of mobile forensics in the healthcare field. An open-ended survey of local healthcare and related facilities around Indianapolis has been explored to examine the current status of Mobile Forensics in the healthcare field. The results have been evaluated using statistical analysis. A methodology is being proposed that would use mobile forensics procedures taking into account the regulatory measures that have to be instituted due to the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Keywords-mobile forensics, healthcare. Evelyn Walton Informatics Indiana University Purdue University Indianapolis 799 W. Michigan...

Words: 4340 - Pages: 18

Premium Essay

Ist 454 Project

...|[pic] |Term Project Guideline |[pic] | Introduction The intent of this project is for your project group to conduct independent investigation and demonstrate an in-depth knowledge of a specific area related to Computer and Cyber Forensics (or digital forensics). The project can take several forms. Your team may (1) design a hands-on lab, (2) develop a comprehensive WWW portal on a topic related to cyber forensics, or (3) choose your own form and substance. Project Details The following paragraphs are guidelines for some of the project options: 1. Hands-on Lab Development Your team may elect to design a hands-on lab (similar to what you have practiced in this class). Your report should include an instructional guide for the lab and a report that documents your team’s exploration and results of the lab. The hands-on lab should cover the detailed process of conducting a complete forensic analysis (imaging, data recovery, and analysis) on selected digital devices or using criminal tools for attack, defense, and data recovery. Here is a list of possible devices or tools: Digital Devices: |Digital Music Device |Mobile Phone | |Flash Memory Cards |RIM (BlackBerry) Wireless Device ...

Words: 822 - Pages: 4

Premium Essay

Testing

...Certifications: A+ ACE Associate Project Manager CAPM Certification CBAP" - Certified Business Analysis Professional CCCI - Certified Computer Crime Investigator CCE - Certified Computer Examiner CCFT - Certified Computer Forensic Technician CCSA/CCSE Check Point CEECS - Certified Electronic Evidence Collection Specialist CEH - Certified Ethical Hacker CEIC - Computer and Enterprise Investigations Conference CFCE - Certified Forensic Computer Examiner CFE - Certified Fraud Examiner CFIA - Certified Forensic Investigation Analyst CHFI - Certified Hacking Forensic Investigator CIFI - Certified International Information Systems Forensic Investigator CISA - Certified Information Systems Auditor CISM - Certified Information Security Manager CISSP - Certified Information Systems Security Professional CISSP-ISSAP - Information Systems Security Architecture Professional CISSP-ISSEP - Information Systems Security Engineering Professional CISSP-ISSMP - Information Systems Security Management Professional CIW - Certified Internet Webmaster CNA - Certified Novell 5 Administrator CNE - Certified Netware Engineer CNSS 4013 Recognition CPE - Certified PGP Engineer - PGP Corporation CSA - Certified Security Analyst CSE - Certified Steganography Examiner CSFA - CyberSecurity Forensic Analyst CSICI - CyberSecurity Institute Certified Instructor CSIH - Certified Computer Security Incident Handler CSTA - Certified Security Testing Associate CSTP - Certified Security...

Words: 1957 - Pages: 8

Premium Essay

Essay On Computer Forensics

...Abstract: Rising era of computer and other technologies as internet and gadgets, explosively increase in number of cybercrime or other crimes using technologies. The growth of computer forensic has taken as huge success to control those crimes which are committed using computers. The main task of computer forensic is to examining and collecting electronic data as evidence from a crime scene. The work of computer forensic is to recover the data which has been hacked or lost by the criminals using different system. The growing dependency on computer forensic has decreased the cybercrime and professionals have to understand the computer technology that is used in computer forensic. Introduction Forensic roots from a Latin word, “forensic” which...

Words: 870 - Pages: 4

Free Essay

Computer Intrusion Forensics

...Computer Intrusion Forensics Research Paper Nathan Balon Ronald Stovall Thomas Scaria CIS 544 Abstract The need for computer intrusion forensics arises from the alarming increase in the number of computer crimes that are committed annually. After a computer system has been breached and an intrusion has been detected, there is a need for a computer forensics investigation to follow. Computer forensics is used to bring to justice, those responsible for conducting attacks on computer systems throughout the world. Because of this the law must be follow precisely when conducting a forensics investigation. It is not enough to simple know an attacker is responsible for the crime, the forensics investigation must be carried out in a precise manner that will produce evidence that is amicable in a court room. For computer intrusion forensics many methodologies have been designed to be used when conducting an investigation. A computer forensics investigator also needs certain skills to conduct the investigation. Along with this, the computer forensics investigator must be equipped with an array of software tools. With the birth of the Internet and networks, the computer intrusion has never been as significant as it is now. There are different preventive measures available, such as access control and authentication, to attempt to prevent intruders. Intrusion detection systems (IDS) are developed to detect an intrusion as it occurs, and to execute countermeasures when detected...

Words: 9608 - Pages: 39

Premium Essay

Advance Issue in Ict

...| | | | | Course Synopsis The course contains current issues in Information and Communication Technology that focus on the area of information science, computer networking, multimedia, medical informatics and information security and computer forensic. Exposure through visitation, events, and seminar will be implemented in this course in order to obtain the global technology as it is impacting all walks of life all over the world. Course Objectives The objectives of this course are: * To expose students to the various area in IT through visitation and events. * To provide a series of seminar in order to gain current issues and trends in ICT. * To develop a knowledgeable and skilled computer professionals guided by the needs of companies and employers. Learning outcomes * Present verbally on current issues in different areas of information and communication technology through group presentation and discussions. * Summarize the latest technology offered in order to solve the real world problem. * Document the finding on current issues and trends in ICT from the series of seminar attended and visitation organized. Recommended/Required Materials Main Reference(s) | Newspapers, magazine, articles, journals, research paper | Course Assessment Participation | : | 5% | Assignments/Project | : | 45% | Final Examination | : |  50% | Total: | 100% | Course Requirements & Policies   Example: You are expected to fulfill the following...

Words: 832 - Pages: 4

Premium Essay

Forensics

...this research paper was to analyze three anti-forensic techniques for potential methods of mitigating their impact on a forensic investigation. Existing research in digital forensics and anti-forensics was used to determine how altered metadata, encryption, and deletion impact the three most prominent operating systems. The common file systems for these operating systems were analyzed to determine if file system analysis could be used to mitigate the impact of the associated anti-forensic technique. The countermeasures identified in this research can be used by investigators to reduce the impact of anti-forensic techniques on an investigation. Also, the results could be used as a basis for additional research. File system analysis can be used to detect and mitigate the impact of the three methods of anti-forensics researched under the right circumstances. Some areas of anti-forensics and file systems have been relatively well-researched. However continued research is necessary to keep pace with changes in file systems as well as anti-forensic techniques. Keywords: Cybersecurity, Albert Orbinati, Windows, Linux, Macintosh, file table. MITIGATING THE IMPACT OF ANTI-FORENSIC TECHNIQUES THROUGH FILE SYSTEM ANALYSIS by Gabriel A. Flynn A Capstone Project Submitted to the Faculty of Utica College August 2012 in Partial Fulfillment of the Requirements for the Degree of Master of Science Cybersecurity – Intelligence & Forensics © Copyright 2012 by Gabriel Flynn All Rights...

Words: 11835 - Pages: 48

Premium Essay

Careers in Psychology Essay

...difference, and that's what I would like to spend the rest of my life doing. The field of psychology is divided into subfields each of which deal with a different area, and since working with and helping people is a good feeling for me, community and social services is an excellent job group. When going into the field of psychology, one is able to explore many different careers. I’m also interested in forensics. The field of forensic psychology has grown in the 21st century because courtrooms recognize the value of psychologist’s testimonies to help juries reach a clearer verdict. Like all fields in psychology, forensics has many perspectives, they can focus on law enforcement psychology, the psychology of litigation, correctional psychology, and forensic psychology (Nietzel, Bernstein, & Milich, 1998). The field of psychology is becoming more scientific, advances are being made to increase reliability. Just the thought of having a career in psychology is fascinating to me, I know sooner or later I am going to have to make the decision on which way Im going to go about it. Forensic psychologists handle legal matters, including mental state examinations of criminal defendants and...

Words: 1127 - Pages: 5

Free Essay

A History of Modern

...Guide to Computer Forensics and Investigations Fourth Edition Chapter 7 Current Computer Forensics Tools Objectives • Explain how to evaluate needs for computer forensics tools • Describe available computer forensics software tools • List some considerations for computer forensics hardware tools • Describe methods for validating and testing computer forensics tools Guide to Computer Forensics and Investigations 2 Evaluating Computer Forensics Tool Needs • Look for versatility, flexibility, and robustness – – – – – OS File system Script capabilities Automated features Vendor’s reputation • Keep in mind what application files you will be analyzing Guide to Computer Forensics and Investigations 3 Types of Computer Forensics Tools • Hardware forensic tools – Range from single-purpose components to complete computer systems and servers • Software forensic tools – Types • Command-line applications • GUI applications – Commonly used to copy data from a suspect’s disk drive to an image file Guide to Computer Forensics and Investigations 4 Tasks Performed by Computer Forensics Tools • Five major categories: – – – – – Acquisition Validation and discrimination Extraction Reconstruction Reporting Guide to Computer Forensics and Investigations 5 Tasks Performed by Computer Forensics Tools (continued) • Acquisition – Making a copy of the original drive • Acquisition subfunctions: – – – – – – – Physical data copy Logical data copy...

Words: 2076 - Pages: 9

Premium Essay

Cyber Law

...Unit-4 (ICS -305) Information security Information security (ISec) describes activities that relate to the protection of information and information infrastructure assets against the risks of loss, misuse, disclosure or damage. Standards that are available to assist organizations implement the appropriate programs and controls to mitigate these risks are for example BS7799/ISO 17799, Information Technology Infrastructure Library and COBIT.  Information security management (ISM) describes controls that an organization needs to implement to ensure that it is sensibly managing these risks. Security Challenges  The risks to these assets can be calculated by analysis of the following issues:  Threats to your assets. These are unwanted events that could cause the intentional or accidental loss, damage or misuse of the assets  Vulnerabilities. How vulnerable (prone or weak) your assets are to attack  Impact. The magnitude of the potential loss or the seriousness of the event. Security services Information Security Governance, Information Security Governance or ISG, is a subset discipline of Corporate Governance focused on information Security systems and their performance and risk management.  Establish and maintain a framework to provide assurance that information security strategies are aligned with business objectives and consistent with applicable laws and regulations  Develop the information security strategy in support of business strategy and...

Words: 1808 - Pages: 8

Free Essay

Forensics

...Name: Nupur Vijay Gholap Weekly Solutions Template Hands on project 4-4: Answer: Case Project 4-5 Answer: To acquire the data from the source file following methods can be used: 1. Disk-to-Image files: FKT Imager can be used to disk-to-image files from other proprietary formats. We need not segment the data as entire 2 GB can be stored directly. FKT runs on the windows and needs write blocking device. FKT can read AccessData, Expert Witness, SafeBack, SMART and raw format files, CD and DVD files. Proprietary format tools run an option to compress or not compress image files of a source drive, to save space on the target drive. Hashing helps check the integrity of the data. Various tools can integrate metadata into the image file But there exits an inability to share an image between different vendors’ computer forensics analysis tools. Like ILook imaging tool IXimager produces IDIF, IRBF, and IEIF but can be read only by ILook. Proprietary format tools produce a segmented file of 650 MB. Maximum file size per segment can be 2 GB. 2. Disk-to-disk copy: UNIX/Linux dd command does disk-to-disk copy. dd command is very easy and effective in a Linux machine. But for that we need equal or larger space in the target disk to copy full image from the source disk. Raw formatting is a technique in which we use dd command to generate image files which are split into smaller segments and are exact bit-by-bit replica of the original disk. These are sequential flat...

Words: 937 - Pages: 4

Free Essay

Computer Forensics Case Analysis

...Project 1 Case Analysis CCJS321 The two cases I have chosen to analyze for Project One is the Max Ray Butler aka “Iceman” cybercrime case and the Albert Gonzalez cybercrime case. I have chosen these two cases because they both had significant impact on the computer forensics field. Both of these cybercrimes are similar in nature because both deal in credit card and identity theft on the grandest scale. Max Ray Butler and Albert Gonzalez were brought to justice after many years of a cyber-forensic investigation that went through a network of multiple U.S. agencies; including the FBI, US Secret Service and US-CERT (United States Computer Emergency Readiness Team) a Department of Homeland Security who were all networked together at the National Computer Forensic Training Academy in Pittsburg, Pennsylvania. Both of these men were given the longest prison sentences ever handed out by a judge for computer crimes of their notoriety and magnitude. Finally, they both set a blue print for digital forensic investigators of the proper procedures to follow in order to capture future want-to-be crime lords. Max Butler aka “Iceman” was a white-hat hacker that went rogue. His story is that, “he was a good hacker hired by the government to test the security of one of their websites, while doing that job he installed a backdoor to their system that would allow him to come in later so he could make some fixes to the system on his own time. Well of course this second part of the...

Words: 1323 - Pages: 6

Premium Essay

Forinsic Accounting

...A Project Report On “Forensic Accounting And Auditing” Submitted By Durvesh S. Naik Roll No: - 6025 MCOM PART-II (Advanced Accountancy) 2014-15 MULUND COLLEGE OF COMMERCE SAROJINI NAIDU ROAD, MULUND (W.) MUMBAI-80 SUBMITTED TO UNIVERSITY OF MUMBAI ACADEMIC YEAR 2014-15 DECLARATION I Durvesh Naik student of Mulund College of Commerce, S. N. Road, Mulund (W.) Mumbai – 80 of Mcom Part II (Advanced Accounting) Seat no: - 6025, hereby declare that I have completed the project on the title “Forensic Accounting and Auditing” during the academic year 2014-15. The information submitted is true and best of my knowledge and belief. Date of submission: - Signature Place:- Parle Tilak Vidyalaya Association's MULUND COLLEGE OF COMMERCE Sarojini Naidu Road, Mulund West, Mumbai 400080. Certificate This is to certify that Mr. __________________________________________________________ Of Mcom. Part II (Advanced Accountancy) Semester _______ has undertaken completed the project work titled _________________________ ______________________________ during the academic year __________ under the guidance of Prof. ______________________________________. Submitted on _________________ to this college on the fulfillment of the curriculum of Mcom (Advanced Accountancy) University of Mumbai. This is a bonafide project work & the information presented is true/ and original to the best of our knowledge...

Words: 8287 - Pages: 34

Premium Essay

Emerging Cybersecurity Strategies

...Abstract: Advanced cyberattacks on the public and private sectors at the local, national, and international level have prompted an increase in funding and support for the study of emerging cybersecurity technologies. The considerations for this paper are to discuss the emerging technologies and strategies that can be integrated across the public and private sector to improve cybersecurity on a local, national, and international level. New technologies need to dynamically assess networks real-time such as with the use of Remote Agents and Real-time forensic analysis. These technologies also need to make the attack space less predictable and constantly evolving such as through the use of moving target defense. Emerging Cybersecurity Technologies The E-government Act of 2000 was signed by President Bush to move toward a more 24-7 government. The dream was to eliminate the need to have to stand in line at the DMV for half a day just to pay annual vehicle registration fees (Barker, 2011). Security was certainly a concern, but it was not at the forefront of the move as government agencies would go through massive changes in equipment, manning, and practices in order to move information and programs online. Now, over a decade later we still see moves and changes taking place, such as the department of Veterans Affairs recently moving all of their applications, forms and records online. The expensive cost of getting the government caught up was expected with such an overhaul...

Words: 2624 - Pages: 11