Introduction - Weeblyphirose.weebly.com/uploads/4/7/8/4/47844911/odinse… · Web viewOverview of...

CFR106 Classification ODIN Securities For Official Use ONLY

Linux File-System AnalysisThis Report Was Prepared By:

Phillip RoseShorey Magnum

Understanding File Systems and Structures IIFrank Griffitts

University of Advancing Technology

The information contained within this report is considered educational and for learning purposes only. Inappropriate and unauthorized disclosure of this report or portions of it

could result in significant damage or negative legal issues. This report should be distributed to individuals on a Need-to-Know basis only. Again this document and all cases are hypothetical and for educational and training

purposes only.


Table of ContentsIntroduction......................................................................................................................................3

Overview of Report.....................................................................................................................3Software Used..................................................................................................................................3

Windows 7...................................................................................................................................3GSpot v2.70a...............................................................................................................................4

Requirements for Assignment.........................................................................................................5Measureable Metrics:...................................................................................................................5


Introduction

Overview of Report

This document is to outline the process’s used by ODIN Securities, (referred to as ODINSEC here out,) in the course of completing learning projects assigned by the teaching at the University of Advancing Technology. (UAT) This document will outline the tools, methodologies, and procedures used to complete assignments.

Requirements for AssignmentYou will receive an image file for analysis. Within this image file is an operating system who’s user has engaged in criminal activities. You are to find and report on those activities.

Measureable Metrics:

The following are considered to be the measurable metrics of the project success, as understood by the author. Each will have its own section with a brief write-up to describe actions taken by the technician, as well as a screen shot showing proof of functionality:

1. Proven toolsets and procedures are used2. Requested evidence is found and properly documented3. Attachment of Generated Reports from Forensic Programs used4. Reasons that suspected evidence is relevant


Overview / Case SummarySpecial agents Smith and Burnes have provided you with an EXT file system/Ubuntu Operating System that needs to be imaged and analyzed for evidence of car theft activities by the computer’s owner “Speedy.”

Speedy is suspected of organizing car thefts based on demand for higher end vehicles and in addition to targeting online ‘for sale’ ad owners vehicles is suspected of targeting valet services at various restaurants and clubs throughout the valley, in particular Scottsdale, Az.

• Information that needs to be recovered if possible include the following:• Any proof of car thefts that have already occurred.• Any proof of planned car thefts.• Find and list any anti forensic software tools.• Any notable internet searches.• Any notable crime related bookmarks.• Any email accounts and exchanges.• Any deleted files.• Any stenographed files that may hold clues to further evidence.• Any encrypted files.• Any proof of accomplices.• Proof that the perpetrator Victor Povlatsky also goes by the name “Speedy.”• Match the file on the suspects system matching the hash value of:

4F01AEA579EE4CBF518D1B4E1BD7FF5FAny other information relevant to this case.


Forensic Acquisition & Exam Preparation

The image analyzed in this document was provided by a reliable technician. All documentation pertaining to the forensic acquisition is assumed to be documented and recorded in ways outlined by the procedures and policies of the CFR106 course. It is understood that this does not fall under best practice for forensic procedure and a proper chain of evidence custody form would be required in order to accept such data for forensic analysis.

The hash value of the image is known to be o 4F01AEA579EE4CBF518D1B4E1BD7FF5F

The image provided is a known clone of the archived image. Technicians are free to work on the image as needed, however, they may be required to replicate their findings on yet another copy of the original image.

Findings and Report (Forensic Analysis)

After receiving the forensic image, toolsets installed on the lab equipment by school faculty where leveraged for a preliminary analysis of information on the machine

The reports generated by Autopsy and Encase have been attached in the attachments section of this document for easy reference.

Examiners used the following tools for forensic analysis, which have been properly licensed through the university.

o Guidance® Software's EnCase® 6.17o Autopsy


Tie Victor Povlatsky to the street name “Speedy.”It is noted in several places that the home folder of the user is labeled as victor. This fits with what would be expected should this computer belong to Victor Povlatsky

The users home folder is located at /img_CFR106Week6SpeedyE.E01/vol_vol2/home/victor/

The proceeding picture shows that the victor account was used to access the email [email protected]

Finally, registration information in the users name and known accounts

Any proof of accomplicesSee email section for screenshot of communication with an unknown associate using an anonymous email service.

mailto:[email protected]


Proof of past car thefts associated with suspect

Proof of future car thefts


Checking the open mailbox [email protected] led us to these emails which implicate victor.



Network Activity of Interest

Proceeding bookmarked page shows intent to store information on the cloud service. Suggest using warrant / law enforcement powers to leverage login information and / or serve warrant for any and all files suspected to be connected to case.

Notable internet searches.


Proceeding internet searches are related to erasing evidence.

Proceeding bookmarks show intent to gain knowledge on best practices for car theft.

Proceeding searches show intent to use SilentEye Stegonagraphy tool


Proceeding bookmarked page shows intent to use encryption on the file system.

Notable crime related bookmarks.

Email accounts and exchanges/conversations

Proceeding image illustrates suspects use of textnow for communication. Suggest warrant for any and all logs pertaining to investigation.

Image illustrates suspect frequented yopmail.com.

Emails of interest from the yopmail account “speedyvictor”


Further evidence of cloudstorage at justcloud.com Email address chosen is [email protected]

An email containing the following body. The subject read List. Also from [email protected]

Model,MPG,Cylinders,Engine Disp,Horsepower,Weight,Accelerate,Year,Originamc ambassador dpl,15.0,8,390,190,3850,8.5,70,Americanamc gremlin,21.0,6,199,90,2648,15.0,70,Americanamc hornet,18.0,6,199,97,2774,15.5,70,Americanamc rebel sst,16.0,8,304,150,3433,12.0,70,Americanbuick estate wagon (sw),14.0,8,455,225,3086,10.0,70,Americanbuick skylark 320,15.0,8,350,165,3693,11.5,70,Americanchevrolet chevelle malibu,18.0,8,307,130,3504,12.0,70,Americanchevrolet impala,14.0,8,454,220,4354,9.0,70,Americanchevrolet monte carlo,15.0,8,400,150,3761,9.5,70,Americanchevy c20,10.0,8,307,200,4376,15.0,70,Americandodge challenger se,15.0,8,383,170,3563,10.0,70,Americandodge d200,11.0,8,318,210,4382,13.5,70,Americanford f250,10.0,8,360,215,4615,14.0,70,Americanford galaxie 500,15.0,8,429,198,4341,10.0,70,American




ford maverick,21.0,6,200,85,2587,16.0,70,Americanford torino,17.0,8,302,140,3449,10.5,70,Americanhi 1200d,9.0,8,304,193,4732,18.5,70,Americanplymouth 'cuda 340,14.0,8,340,160,3609,8.0,70,Americanplymouth duster,22.0,6,198,95,2833,15.5,70,Americanplymouth fury iii,14.0,8,440,215,4312,8.5,70,Americanplymouth satellite,18.0,8,318,150,3436,11.0,70,Americanpontiac catalina,14.0,8,455,225,4425,10.0,70,Americanaudi 100 ls,24.0,4,107,90,2430,14.5,70,Europeanbmw 2002,26.0,4,121,113,2234,12.5,70,Europeanpeugeot 504,25.0,4,110,87,2672,17.5,70,Europeansaab 99e,25.0,4,104,95,2375,17.5,70,Europeanvolkswagen 1131 deluxe sedan,26.0,4,97,46,1835,20.5,70,Europeandatsun pl510,27.0,4,97,88,2130,14.5,70,Japanesetoyota corona mark ii,24.0,4,113,95,2372,15.0,70,Japaneseamc gremlin,19.0,6,232,100,2634,13.0,71,Americanamc hornet sportabout (sw),18.0,6,258,110,2962,13.5,71,Americanamc matador,18.0,6,232,100,3288,15.5,71,Americanchevrolet chevelle malibu,17.0,6,250,100,3329,15.5,71,Americanchevrolet impala,14.0,8,350,165,4209,12.0,71,Americanchevrolet vega (sw),22.0,4,140,72,2408,19.0,71,Americanchevrolet vega 2300,28.0,4,140,90,2264,15.5,71,Americandodge monaco (sw),12.0,8,383,180,4955,11.5,71,Americanford country squire (sw),13.0,8,400,170,4746,12.0,71,Americanford galaxie 500,14.0,8,351,153,4154,13.5,71,Americanford mustang,18.0,6,250,88,3139,14.5,71,Americanford torino 500,19.0,6,250,88,3302,15.5,71,Americanmercury capri 2000,23.0,4,122,86,2220,14.0,71,Americanplymouth cricket,26.0,4,91,70,1955,20.5,71,Americanplymouth fury iii,14.0,8,318,150,4096,13.0,71,Americanplymouth satellite custom,16.0,6,225,105,3439,15.5,71,Americanpontiac catalina brougham,14.0,8,400,175,4464,11.5,71,Americanpontiac firebird,19.0,6,250,100,3282,15.0,71,Americanpontiac safari (sw),13.0,8,400,175,5140,12.0,71,Americanfiat 124b,30.0,4,88,76,2065,14.5,71,Europeanopel 1900,28.0,4,116,90,2123,14.0,71,Europeanpeugeot 304,30.0,4,79,70,2074,19.5,71,Europeanvolkswagen model 111,27.0,4,97,60,1834,19.0,71,Europeandatsun 1200,35.0,4,72,69,1613,18.0,71,Japanesedatsun pl510,27.0,4,97,88,2130,14.5,71,Japanesetoyota corolla 1200,31.0,4,71,65,1773,19.0,71,Japanesetoyota corona,25.0,4,113,95,2228,14.0,71,Japaneseamc ambassador sst,17.0,8,304,150,3672,11.5,72,Americanamc matador (sw),15.0,8,304,150,3892,12.5,72,Americanbuick lesabre custom,13.0,8,350,155,4502,13.5,72,Americanchevrolet chevelle concours (sw),13.0,8,307,130,4098,14.0,72,Americanchevrolet impala,13.0,8,350,165,4274,12.0,72,Americanchevrolet vega,20.0,4,140,90,2408,19.5,72,Americanchrysler newport royal,13.0,8,400,190,4422,12.5,72,Americandodge colt (sw),28.0,4,98,80,2164,15.0,72,Americandodge colt hardtop,25.0,4,97.5,80,2126,17.0,72,Americanford galaxie 500,14.0,8,351,153,4129,13.0,72,Americanford gran torino (sw),13.0,8,302,140,4294,16.0,72,Americanford pinto (sw),22.0,4,122,86,2395,16.0,72,Americanford pinto runabout,21.0,4,122,86,2226,16.5,72,Americanmercury marquis,11.0,8,429,208,4633,11.0,72,American


oldsmobile delta 88 royale,12.0,8,350,160,4456,13.5,72,Americanplymouth fury iii,15.0,8,318,150,4135,13.5,72,Americanplymouth satellite custom (sw),14.0,8,318,150,4077,14.0,72,Americanpontiac catalina,14.0,8,400,175,4385,12.0,72,Americanpeugeot 504 (sw),21.0,4,120,87,2979,19.5,72,Europeanrenault 12 (sw),26.0,4,96,69,2189,18.0,72,Europeanvolkswagen 411 (sw),22.0,4,121,76,2511,18.0,72,Europeanvolkswagen type 3,23.0,4,97,54,2254,23.5,72,Europeanvolvo 145e (sw),18.0,4,121,112,2933,14.5,72,Europeandatsun 510 (sw),28.0,4,97,92,2288,17.0,72,Japanesemazda rx2 coupe,19.0,3,70,97,2330,13.5,72,Japanesetoyota corolla 1600 (sw),27.0,4,97,88,2100,16.5,72,Japanesetoyota corona hardtop,24.0,4,113,95,2278,15.5,72,Japanesetoyouta corona mark ii (sw),23.0,4,120,97,2506,14.5,72,Japaneseamc ambassador brougham,13.0,8,360,175,3821,11.0,73,Americanamc gremlin,18.0,6,232,100,2789,15.0,73,Americanamc hornet,18.0,6,232,100,2945,16.0,73,Americanamc matador,14.0,8,304,150,3672,11.5,73,Americanbuick century 350,13.0,8,350,175,4100,13.0,73,Americanbuick electra 225 custom,12.0,8,455,225,4951,11.0,73,Americanchevrolet caprice classic,13.0,8,400,150,4464,12.0,73,Americanchevrolet impala,11.0,8,400,150,4997,14.0,73,Americanchevrolet malibu,13.0,8,350,145,3988,13.0,73,Americanchevrolet monte carlo s,15.0,8,350,145,4082,13.0,73,Americanchevrolet nova custom,16.0,6,250,100,3278,18.0,73,Americanchevrolet vega,21.0,4,140,72,2401,19.5,73,Americanchrysler new yorker brougham,13.0,8,440,215,4735,11.0,73,Americandodge coronet custom,15.0,8,318,150,3777,12.5,73,Americandodge dart custom,15.0,8,318,150,3399,11.0,73,Americanford country,12.0,8,400,167,4906,12.5,73,Americanford gran torino,14.0,8,302,137,4042,14.5,73,Americanford ltd,13.0,8,351,158,4363,13.0,73,Americanford maverick,18.0,6,250,88,3021,16.5,73,Americanford pinto,19.0,4,122,85,2310,18.5,73,Americanmercury capri v6,21.0,6,155,107,2472,14.0,73,Americanmercury marquis brougham,12.0,8,429,198,4952,11.5,73,Americanoldsmobile omega,11.0,8,350,180,3664,11.0,73,Americanoldsmobile vista cruiser,12.0,8,350,180,4499,12.5,73,Americanplymouth custom suburb,13.0,8,360,170,4654,13.0,73,Americanplymouth duster,23.0,6,198,95,2904,16.0,73,Americanplymouth fury gran sedan,14.0,8,318,150,4237,14.5,73,Americanplymouth valiant,18.0,6,225,105,3121,16.5,73,Americanpontiac grand prix,16.0,8,400,230,4278,9.5,73,Americanaudi 100ls,20.0,4,114,91,2582,14.0,73,Europeanfiat 124 sport coupe,26.0,4,98,90,2265,15.5,73,Europeanfiat 128,29.0,4,68,49,1867,19.5,73,Europeanopel manta,24.0,4,116,75,2158,15.5,73,Europeansaab 99le,24.0,4,121,110,2660,14.0,73,Europeanvolkswagen super beetle,26.0,4,97,46,1950,21.0,73,Europeanvolvo 144ea,19.0,4,121,112,2868,15.5,73,Europeandatsun 610,22.0,4,108,94,2379,16.5,73,Japanesemaxda rx3,18.0,3,70,90,2124,13.5,73,Japanesetoyota carina,20.0,4,97,88,2279,19.0,73,Japanesetoyota mark ii,20.0,6,156,122,2807,13.5,73,Japaneseamc hornet,19.0,6,232,100,2901,16.0,74,Americanamc matador,16.0,6,258,110,3632,18.0,74,American


amc matador (sw),14.0,8,304,150,4257,15.5,74,Americanbuick century luxus (sw),13.0,8,350,150,4699,14.5,74,Americanchevrolet chevelle malibu classic,16.0,6,250,100,3781,17.0,74,Americanchevrolet nova,15.0,6,250,100,3336,17.0,74,Americanchevrolet vega,25.0,4,140,75,2542,17.0,74,Americandodge colt,28.0,4,90,75,2125,14.5,74,Americandodge coronet custom (sw),14.0,8,318,150,4457,13.5,74,Americanford gran torino,16.0,8,302,140,4141,14.0,74,Americanford gran torino (sw),14.0,8,302,140,4638,16.0,74,Americanford pinto,26.0,4,122,80,2451,16.5,74,Americanplymouth duster,20.0,6,198,95,3102,16.5,74,Americanplymouth satellite sebring,18.0,6,225,105,3613,16.5,74,Americanaudi fox,29.0,4,98,83,2219,16.5,74,Europeanfiat 124 tc,26.0,4,116,75,2246,14.0,74,Europeanfiat 128,24.0,4,90,75,2108,15.5,74,Europeanfiat x1.9,31.0,4,79,67,2000,16.0,74,Europeanopel manta,26.0,4,97,78,2300,14.5,74,Europeanvolkswagen dasher,26.0,4,79,67,1963,15.5,74,Europeandatsun 710,32.0,4,83,61,2003,19.0,74,Japanesedatsun b210,31.0,4,79,67,1950,19.0,74,Japanesehonda civic,24.0,4,120,97,2489,15.0,74,Japanesesubaru,26.0,4,108,93,2391,15.5,74,Japanesetoyota corolla 1200,32.0,4,71,65,1836,21.0,74,Japanesetoyota corona,31.0,4,76,52,1649,16.5,74,Japaneseamc gremlin,20.0,6,232,100,2914,16.0,75,Americanamc matador,15.0,6,258,110,3730,19.0,75,Americanamc pacer,19.0,6,232,90,3211,17.0,75,Americanbuick century,17.0,6,231,110,3907,21.0,75,Americanbuick skyhawk,21.0,6,231,110,3039,15.0,75,Americanchevroelt chevelle malibu,16.0,6,250,105,3897,18.5,75,Americanchevrolet bel air,15.0,8,350,145,4440,14.0,75,Americanchevrolet monza 2+2,20.0,8,262,110,3221,13.5,75,Americanchevrolet nova,18.0,6,250,105,3459,16.0,75,Americanford ltd,14.0,8,351,148,4657,13.5,75,Americanford maverick,15.0,6,250,72,3158,19.5,75,Americanford mustang ii,13.0,8,302,129,3169,12.0,75,Americanford pinto,23.0,4,140,83,2639,17.0,75,Americanford pinto,18.0,6,171,97,2984,14.5,75,Americanmercury monarch,15.0,6,250,72,3432,21.0,75,Americanplymouth fury,18.0,6,225,95,3785,19.0,75,Americanplymouth grand fury,16.0,8,318,150,4498,14.5,75,Americanplymouth valiant custom,19.0,6,225,95,3264,16.0,75,Americanpontiac astro,23.0,4,140,78,2592,18.5,75,Americanpontiac catalina,16.0,8,400,170,4668,11.5,75,Americanaudi 100ls,23.0,4,115,95,2694,15.0,75,Europeanpeugeot 504,23.0,4,120,88,2957,17.0,75,Europeansaab 99le,25.0,4,121,115,2671,13.5,75,Europeanvolkswagen dasher,25.0,4,90,71,2223,16.5,75,Europeanvolkswagen rabbit,29.0,4,90,70,1937,14.0,75,Europeanvolvo 244dl,22.0,4,121,98,2945,14.5,75,Europeandatsun 710,24.0,4,119,97,2545,17.0,75,Japanesehonda civic cvcc,33.0,4,91,53,1795,17.5,75,Japanesetoyota corolla,29.0,4,97,75,2171,16.0,75,Japanesetoyota corona,24.0,4,134,96,2702,13.5,75,Japaneseamc hornet,22.5,6,232,90,3085,17.6,76,Americanamc matador,15.5,8,304,120,3962,13.9,76,American


amc pacer d/l,17.5,6,258,95,3193,17.8,76,Americancadillac seville,16.5,8,350,180,4380,12.1,76,Americancapri ii,25.0,4,140,92,2572,14.9,76,Americanchevrolet chevelle malibu classic,17.5,8,305,140,4215,13.0,76,Americanchevrolet chevette,29.0,4,85,52,2035,22.2,76,Americanchevrolet nova,22.0,6,250,105,3353,14.5,76,Americanchevrolet woody,24.5,4,98,60,2164,22.1,76,Americanchevy c10,13.0,8,350,145,4055,12.0,76,Americandodge aspen se,20.0,6,225,100,3651,17.7,76,Americandodge colt,26.0,4,98,79,2255,17.7,76,Americandodge coronet brougham,16.0,8,318,150,4190,13.0,76,Americandodge d100,13.0,8,318,150,3755,14.0,76,Americanford f108,13.0,8,302,130,3870,15.0,76,Americanford gran torino,14.5,8,351,152,4215,12.8,76,Americanford granada ghia,18.0,6,250,78,3574,21.0,76,Americanford maverick,24.0,6,200,81,3012,17.6,76,Americanford pinto,26.5,4,140,72,2565,13.6,76,Americanplymouth valiant,22.0,6,225,100,3233,15.4,76,Americanplymouth volare premier v8,13.0,8,318,150,3940,13.2,76,Americanpontiac ventura sj,18.5,6,250,110,3645,16.2,76,Americanfiat 131,28.0,4,107,86,2464,15.5,76,Europeanmercedes-benz 280s,16.5,6,168,120,3820,16.7,76,Europeanopel 1900,25.0,4,116,81,2220,16.9,76,Europeanpeugeot 504,19.0,4,120,88,3270,21.9,76,Europeanrenault 12tl,27.0,4,101,83,2202,15.3,76,Europeanvolkswagen rabbit,29.5,4,97,71,1825,12.2,76,Europeanvolvo 245,20.0,4,130,102,3150,15.7,76,Europeanvw rabbit,29.0,4,90,70,1937,14.2,76,Europeandatsun b-210,32.0,4,85,70,1990,17.0,76,Japanesehonda civic,33.0,4,91,53,1795,17.4,76,Japanesetoyota corolla,28.0,4,97,75,2155,16.4,76,Japanesetoyota mark ii,19.0,6,156,108,2930,15.5,76,Japanesebuick opel isuzu deluxe,30.0,4,111,80,2155,14.8,77,Americanbuick skylark,20.5,6,231,105,3425,16.9,77,Americanchevrolet caprice classic,17.5,8,305,145,3880,12.5,77,Americanchevrolet chevette,30.5,4,98,63,2051,17.0,77,Americanchevrolet concours,17.5,6,250,110,3520,16.4,77,Americanchevrolet monte carlo landau,15.5,8,350,170,4165,11.4,77,Americanchrysler cordoba,15.5,8,400,190,4325,12.2,77,Americandodge colt m/m,33.5,4,98,83,2075,15.9,77,Americandodge monaco brougham,15.5,8,318,145,4140,13.7,77,Americanford granada,18.5,6,250,98,3525,19.0,77,Americanford mustang ii 2+2,25.5,4,140,89,2755,15.8,77,Americanford thunderbird,16.0,8,351,149,4335,14.5,77,Americanmercury cougar brougham,15.0,8,302,130,4295,14.9,77,Americanoldsmobile cutlass supreme,17.0,8,260,110,4060,19.0,77,Americanplymouth arrow gs,25.5,4,122,96,2300,15.5,77,Americanplymouth volare custom,19.0,6,225,100,3630,17.7,77,Americanpontiac grand prix lj,16.0,8,400,180,4220,11.1,77,Americanpontiac sunbird coupe,24.5,4,151,88,2740,16.0,77,Americanbmw 320i,21.5,4,121,110,2600,12.8,77,Europeanrenault 5 gtl,36.0,4,79,58,1825,18.6,77,Europeanvolkswagen dasher,30.5,4,97,78,2190,14.1,77,Europeanvolkswagen rabbit custom,29.0,4,97,78,1940,14.5,77,Europeandatsun 810,22.0,6,146,97,2815,14.5,77,Japanesedatsun f-10 hatchback,33.5,4,85,70,1945,16.8,77,Japanese


honda accord cvcc,31.5,4,98,68,2045,18.5,77,Japanesemazda rx-4,21.5,3,80,110,2720,13.5,77,Japanesesubaru dl,30.0,4,97,67,1985,16.4,77,Japanesetoyota corolla liftback,26.0,4,97,75,2265,18.2,77,Japaneseamc concord,19.4,6,232,90,3210,17.2,78,Americanamc concord d/l,18.1,6,258,120,3410,15.1,78,Americanbuick century special,20.6,6,231,105,3380,15.8,78,Americanbuick regal sport coupe (turbo),17.7,6,231,165,3445,13.4,78,Americanchevrolet chevette,30.0,4,98,68,2155,16.5,78,Americanchevrolet malibu,20.5,6,200,95,3155,18.2,78,Americanchevrolet monte carlo landau,19.2,8,305,145,3425,13.2,78,Americandodge aspen,18.6,6,225,110,3620,18.7,78,Americandodge diplomat,19.4,8,318,140,3735,13.2,78,Americandodge magnum xe,17.5,8,318,140,4080,13.7,78,Americandodge omni,30.9,4,105,75,2230,14.5,78,Americanford fairmont (auto),20.2,6,200,85,2965,15.8,78,Americanford fairmont (man),25.1,4,140,88,2720,15.4,78,Americanford fiesta,36.1,4,98,66,1800,14.4,78,Americanford futura,18.1,8,302,139,3205,11.2,78,Americanmercury monarch ghia,20.2,8,302,139,3570,12.8,78,Americanmercury zephyr,20.8,6,200,85,3070,16.7,78,Americanoldsmobile cutlass salon brougham,19.9,8,260,110,3365,15.5,78,Americanoldsmobile starfire sx,23.8,4,151,85,2855,17.6,78,Americanplymouth sapporo,23.2,4,156,105,2745,16.7,78,Americanplymouth volare,20.5,6,225,100,3430,17.2,78,Americanpontiac phoenix lj,19.2,6,231,105,3535,19.2,78,Americanaudi 5000,20.3,5,131,103,2830,15.9,78,Europeanpeugeot 604sl,16.2,6,163,133,3410,15.8,78,Europeansaab 99gle,21.6,4,121,115,2795,15.7,78,Europeanvolkswagen rabbit custom diesel,43.1,4,90,48,1985,21.5,78,Europeanvolkswagen scirocco,31.5,4,89,71,1990,14.9,78,Europeanvolvo 264gl,17.0,6,163,125,3140,13.6,78,Europeandatsun 200-sx,23.9,4,119,97,2405,14.9,78,Japanesedatsun 510,27.2,4,119,97,2300,14.7,78,Japanesedatsun b210 gx,39.4,4,85,70,2070,18.6,78,Japanesehonda accord lx,29.5,4,98,68,2135,16.6,78,Japanesehonda civic cvcc,36.1,4,91,60,1800,16.4,78,Japanesemazda glc deluxe,32.8,4,78,52,1985,19.4,78,Japanesetoyota celica gt liftback,21.1,4,134,95,2515,14.8,78,Japanesetoyota corona,27.5,4,134,95,2560,14.2,78,Japaneseamc concord dl 6,20.2,6,232,90,3265,18.2,79,Americanamc spirit dl,27.4,4,121,80,2670,15.0,79,Americanbuick estate wagon (sw),16.9,8,350,155,4360,14.9,79,Americanbuick skylark limited,28.4,4,151,90,2670,16.0,79,Americancadillac eldorado,23.0,8,350,125,3900,17.4,79,Americanchevrolet caprice classic,17.0,8,305,130,3840,15.4,79,Americanchevrolet citation,28.8,6,173,115,2595,11.3,79,Americanchevrolet malibu classic (sw),19.2,8,267,125,3605,15.0,79,Americanchrysler lebaron town @ country (sw),18.5,8,360,150,3940,13.0,79,Americandodge aspen 6,20.6,6,225,110,3360,16.6,79,Americandodge colt hatchback custom,35.7,4,98,80,1915,14.4,79,Americandodge st. regis,18.2,8,318,135,3830,15.2,79,Americanford country squire (sw),15.5,8,351,142,4054,14.3,79,Americanford fairmont 4,22.3,4,140,88,2890,17.3,79,Americanford ltd landau,17.6,8,302,129,3725,13.4,79,Americanmercury grand marquis,16.5,8,351,138,3955,13.2,79,American


mercury zephyr 6,19.8,6,200,85,2990,18.2,79,Americanoldsmobile cutlass salon brougham,23.9,8,260,90,3420,22.2,79,Americanoldsmobile omega brougham,26.8,6,173,115,2700,12.9,79,Americanplymouth horizon,34.2,4,105,70,2200,13.2,79,Americanplymouth horizon tc3,34.5,4,105,70,2150,14.9,79,Americanpontiac lemans v6,21.5,6,231,115,3245,15.4,79,Americanpontiac phoenix,33.5,4,151,90,2556,13.2,79,Americanfiat strada custom,37.3,4,91,69,2130,14.7,79,Europeanmercedes benz 300d,25.4,5,183,77,3530,20.1,79,Europeanpeugeot 504,27.2,4,141,71,3190,24.8,79,Europeanvw rabbit custom,31.9,4,89,71,1925,14.0,79,Europeandatsun 210,31.8,4,85,65,2020,19.2,79,Japanesemaxda glc deluxe,34.1,4,86,65,1975,15.2,79,Japaneseamc concord,24.3,4,151,90,3003,20.1,80,Americanchevrolet chevette,32.1,4,98,70,2120,15.5,80,Americanchevrolet citation,28.0,4,151,90,2678,16.5,80,Americandodge aspen,19.1,6,225,90,3381,18.7,80,Americandodge colt,27.9,4,156,105,2800,14.4,80,Americanford fairmont,26.4,4,140,88,2870,18.1,80,Americanaudi 4000,34.3,4,97,78,2188,15.8,80,Europeanaudi 5000s (diesel),36.4,5,121,67,2950,19.9,80,Europeanmercedes-benz 240d,30.0,4,146,67,3250,21.8,80,Europeantriumph tr7 coupe,35.0,4,122,88,2500,15.1,80,Europeanvokswagen rabbit,29.8,4,89,62,1845,15.3,80,Europeanvw dasher (diesel),43.4,4,90,48,2335,23.7,80,Europeanvw rabbit,41.5,4,98,76,2144,14.7,80,Europeanvw rabbit c (diesel),44.3,4,90,48,2085,21.7,80,Europeandatsun 210,40.8,4,85,65,2110,19.2,80,Japanesedatsun 280-zx,32.7,6,168,132,2910,11.4,80,Japanesedatsun 310,37.2,4,86,65,2019,16.4,80,Japanesedatsun 510 hatchback,37.0,4,119,92,2434,15.0,80,Japanesehonda accord,32.4,4,107,72,2290,17.0,80,Japanesehonda civic 1500 gl,44.6,4,91,67,1850,13.8,80,Japanesemazda 626,31.3,4,120,75,2542,17.5,80,Japanesemazda glc,46.6,4,86,65,2110,17.9,80,Japanesemazda rx-7 gs,23.7,3,70,100,2420,12.5,80,Japanesesubaru dl,33.8,4,97,67,2145,18.0,80,Japanesetoyota corolla,32.2,4,108,75,2265,15.2,80,Japanesetoyota corolla tercel,38.1,4,89,60,1968,18.8,80,Japanesetoyota corona liftback,29.8,4,134,90,2711,15.5,80,Japanesebuick century,22.4,6,231,110,3415,15.8,81,Americanbuick skylark,26.6,4,151,84,2635,16.4,81,Americanchevrolet citation,23.5,6,173,110,2725,12.6,81,Americanchrysler lebaron salon,17.6,6,225,85,3465,16.6,81,Americandodge aries wagon (sw),25.8,4,156,92,2620,14.4,81,Americanford escort 2h,29.9,4,98,65,2380,20.7,81,Americanford escort 4w,34.4,4,98,65,2045,16.2,81,Americanford granada gl,20.2,6,200,88,3060,17.1,81,Americanoldsmobile cutlass ls,26.6,8,350,105,3725,19.0,81,Americanplymouth champ,39.0,4,86,64,1875,16.4,81,Americanplymouth horizon 4,34.7,4,105,63,2215,14.9,81,Americanplymouth reliant,27.2,4,135,84,2490,15.7,81,Americanplymouth reliant,30.0,4,135,84,2385,12.9,81,Americanpeugeot 505s turbo diesel,28.1,4,141,80,3230,20.4,81,Europeanvolkswagen jetta,33.0,4,105,74,2190,14.2,81,Europeanvolvo diesel,30.7,6,145,76,3160,19.6,81,European


datsun 200sx,32.9,4,119,100,2615,14.8,81,Japanesedatsun 210 mpg,37.0,4,85,65,1975,19.4,81,Japanesedatsun 810 maxima,24.2,6,146,120,2930,13.8,81,Japanesehonda civic 1300,35.1,4,81,60,1760,16.1,81,Japanesehonda prelude,33.7,4,107,75,2210,14.4,81,Japanesemazda 626,31.6,4,120,74,2635,18.3,81,Japanesemazda glc 4,34.1,4,91,68,1985,16.0,81,Japanesesubaru,32.3,4,97,67,2065,17.8,81,Japanesetoyota corolla,32.4,4,108,75,2350,16.8,81,Japanesetoyota cressida,25.4,6,168,116,2900,12.6,81,Japanesetoyota starlet,39.1,4,79,58,1755,16.9,81,Japanesetoyota tercel,37.7,4,89,62,2050,17.3,81,Japanesebuick century limited,25.0,6,181,110,2945,16.4,82,Americanchevrolet camaro,27.0,4,151,90,2950,17.3,82,Americanchevrolet cavalier,28.0,4,112,88,2605,19.6,82,Americanchevrolet cavalier 2-door,34.0,4,112,88,2395,18.0,82,Americanchevrolet cavalier wagon,27.0,4,112,88,2640,18.6,82,Americanchevy s-10,31.0,4,119,82,2720,19.4,82,Americanchrysler lebaron medallion,26.0,4,156,92,2585,14.5,82,Americandodge aries se,29.0,4,135,84,2525,16.0,82,Americandodge charger 2.2,36.0,4,135,84,2370,13.0,82,Americandodge rampage,32.0,4,135,84,2295,11.6,82,Americanford fairmont futura,24.0,4,140,92,2865,16.4,82,Americanford granada l,22.0,6,232,112,2835,14.7,82,Americanford mustang gl,27.0,4,140,86,2790,15.6,82,Americanford ranger,28.0,4,120,79,2625,18.6,82,Americanmercury lynx l,36.0,4,98,70,2125,17.3,82,Americanoldsmobile cutlass ciera (diesel),38.0,6,262,85,3015,17.0,82,Americanplymouth horizon miser,38.0,4,105,63,2125,14.7,82,Americanpontiac j2000 se hatchback,31.0,4,112,85,2575,16.2,82,Americanpontiac phoenix,27.0,4,151,90,2735,18.0,82,Americanvolkswagen rabbit l,36.0,4,105,74,1980,15.3,82,Europeanvw pickup,44.0,4,97,52,2130,24.6,82,Europeandatsun 310 gx,38.0,4,91,67,1995,16.2,82,Japanesehonda accord,36.0,4,107,75,2205,14.5,82,Japanesehonda civic,38.0,4,91,67,1965,15.0,82,Japanesehonda civic (auto),32.0,4,91,67,1965,15.7,82,Japanesemazda glc custom,31.0,4,91,68,1970,17.6,82,Japanesemazda glc custom l,37.0,4,91,68,2025,18.2,82,Japanesenissan stanza xe,36.0,4,120,88,2160,14.5,82,Japanesetoyota celica gt,32.0,4,144,96,2665,13.9,82,Japanesetoyota corolla,34.0,4,108,70,2245,16.9,82,Japanese


Cloud StorageThe following picture was the sole file uploaded to the speedyvictor@yopmail cloud storage account. Ensure that it is checked with steganography tools


Anti-Forensics

Identification of anti forensic software tools.

The proceeding bookmarks show an intent to attain information on anti-forensics techniques.

Proceeding picture illustrates that the user may have employed hidemyass vpn. Suggest requesting warrant for any logs pertaining to Victor.

Evidence of Steagonagraphy

Any encrypted files.


ConclusionThrough the use of several anonymizing services, the suspect has self-incriminated by including his real name combined with his street name. The account name speedyvictor is used whenever the suspect needed to create an account ot be known to his associates.

By following the trail of these services, we were able to uncover several conversations referencing the theft of vehicles. These conversations prove that the crimes where thought out in advance, by a party of more than 1, showing intent to commit conspiracy on top of other chargeable crimes.

The suspect made use of knowledge pertaining to forensic techniques and leveraged several practices and tools to facilitate the destruction of information recoverable by such techniques.

All required evidence to charge the suspect has been annotated through screen captures of online communications. Relevant information to paint a picture of criminal activity over a period of time has been included as well.

Attachments

Autopsy Report Contained in 7-zip container Generated in HTML format

Introduction - Weeblyphirose.weebly.com/uploads/4/7/8/4/47844911/odinse… · Web viewOverview of...

Documents

Transcript of Introduction - Weeblyphirose.weebly.com/uploads/4/7/8/4/47844911/odinse… · Web viewOverview of...