casey jackman, craig marshall. meet carol general approach general disk information os user...
TRANSCRIPT
General Approach
General Disk Information OS User accounts Programs/Applications installed Discover relevant data Build Profile Timeline
Forensics Tools Used
AccessData FTK LiveView VM Ware Server Google/Maps Street View Whitepages.com Password Recovery Tool Kit (PRTK) Cain and Able (Password Cracking) Motobit.com AIF Decoder
1996
Creation date of First file on disk: various OLE streams
6/27/1996
Windows Install: Conclusion based on the creation dates of core OS files.
7/7/1997
Strange cartoon of naked woman is created on drive.
12/24/1997
Novell installed.10/14/1998
Softstuff screen saver installed.
1/6/1999
Pervasive SQL installed
5/17/1999
JAMESH account created. James
Hill(Systems Admin)
12/14/1999
Nada Car Guide installed12/14/1999
SHARONC account created. Sharon Child(Title Clerk)
12/20/1999
CAROLG account created. Carol Goldsberry(Construction Loans) 3/21/2000
MICHELLE account created.
4/12/2000
DAVEP account created. Dave
Purdon(Network Admin)
4/12/2000
UCCU starts new email
system 8/4/2000
Carol begins using outlook
express8/4/2000
Year 2000 audit report is received in an email
9/14/2000
UCCU begins new Authorization System10/2/2000
Carol accesses CNN.com3/19/2001
Carol access insideucc.com3/20/2001
Carol logs in for last time3/21/2001
Email is last accessed3/21/2001
Administrator account is created2/10/2003
Last email in outbox1/31/2001
Last email received1/12/2001
Goldsberry Christmas letter received1/21/2000
Last email sent12/18/2000
UCCU has Christmas party at Aspen Grove12/18/2000
KARENP account created. Karen Peterson 10/23/2000
Jim and Alise Wise Christmas letter received10/18/2000
1997
1998
1999
2002
2000
2003
2001
2004
System
Installations
Accounts
UCCU
Carol Goldsberry
Drive Profile
OPERATION SYSTEM: Windows 95 ADMIN USERNAME: admin ADMIN PASSWORD: admin DRIVE SIZE: 1.5GB FIRST KNOWN OPERATION DATE:
6/27/1996 LAST KNOWN OPERATION DATE:
2/10/2003 SIGNIFICANT APPLICATION
INSTALLATIONS: Pervasive SQL, Nada Car Guide, Novell Client, Outlook Express
[Password Lists]
[PASSWORD LISTS] UCCU=C:\WINDOWS\UCCU.PWL JDW=C:\WINDOWS\JDW.PWL DENZILD=C:\WINDOWS\DENZILD.PWL JOSEPHW=C:\WINDOWS\JOSEPHW.PWL JOEW=C:\WINDOWS\JOEW.PWL CAROLG=C:\WINDOWS\CAROLG.PWL CONNIEH=C:\WINDOWS\CONNIEH.PWL LAROSEH=C:\WINDOWS\LAROSEH.PWL SAUNDRAG=C:\WINDOWS\SAUNDRAG.PWL JAMESH=C:\WINDOWS\JAMESH.PWL SHARONC=C:\WINDOWS\SHARONC.PWL MICHELLEM=C:\WINDOWS\MICHELLE.PWL DAVEP=C:\WINDOWS\DAVEP.PWL KARENP=C:\WINDOWS\KARENP.PWL
Company Profile
COMPANY NAME: Utah Community Credit Union
COMPANY BRANCH: River Woods BRANCH PHONE NUMBER: (801)
223 7656 COMPANY DESCRIPTION: Credit
Union providing financial services and information
BRANCH ADDRESS: 188 W. River Park Drive Provo, UT 84603
User Profile (Primary User) FULL NAME: Carol Goldsberry POSITION: Construction Loan
Specialist USERNAME: carolg EMAIL PASSWORD: carolg EMAIL ADDRESS: [email protected] WORK PHONE NUMBER: (801) 223
7625
Interesting Findings
Administrative User Password Carolg email settings and Password AIF Decode Corporate Directory Audit Report Monthly Technology Newsletter
Technology News Letter
“If you haven't already taken the opportunity to test the new system, we urge you to do so before October 2. You can access it by enter BYUALT at the USERNAME prompt when logging into DataSafe. Enter TEMP0 (TEMP "zero") as the password. Your Teller number remains the same and your password is your last name. This is a test directory, so feel free to enter as many transactions as you would like to ensure that it will work for you when we go live. Report any problems to James Hill (ext. 462).”