AC468 Unit 10 Forensic Examination Report Example

Twelve Findings, Each With an Exhibit: A Unit 10 Forensic Examination Report on a Diverted Supplier Payment

[Student Name]

Purdue University Global

AC468: Digital Forensics and Investigative Techniques

Unit 10 Examination Report

[Instructor Name]

[Date]

Belmonte Fine Foods, its staff, devices, domains and exhibits are composite; hash values are shortened illustrations; the rule, case, guide and articles cited are real.

Summary of Findings

1. The Edge profile on the accounts payable lead's laptop requested a registrar's checkout page for a lookalike of the supplier's domain, one hyphen longer, on March 12 at 17:31 UTC (Exhibits 4, 5).

2. The registry's public record shows the lookalike domain created three minutes after that request (Exhibit 6).

3. A flash drive found in the employee's desk was first connected to the laptop on March 13 at 19:02 UTC (Exhibit 7).

4. A letter announcing new bank details for the supplier was created on that flash drive on March 13 at 19:05 UTC and recovered after deletion (Exhibits 8, 9).

5. The shortcut file and Word jump list show the letter opened from the flash drive four times between March 13 and March 17 (Exhibits 10, 11).

6. A copy of the letter on the laptop's desktop had its visible creation date set earlier than its file system record allows (Exhibit 12).

7. The profile requested a webmail provider's login page on March 17 at 15:06 UTC (Exhibit 13).

8. A message from the lookalike domain carrying the letter as a PDF reached the employee's mailbox at 15:38 UTC (Exhibits 14, 15).

9. The Received chain places that message's entry into Belmonte's tenant from the webmail provider's relay (Exhibit 15).

10. An inbox rule moving all mail from the supplier's real domain into a little-used folder was created in the mailbox at 15:50 UTC (Exhibit 16).

11. Every sign-in to the account in March came from known locations with multifactor authentication (Exhibit 17).

12. A vendor master edit replacing the supplier's bank account, approved by the accounts payable manager, appears in the ERP log on March 18 at 14:12 UTC (Exhibit 18).

Scope and Authority

Outside counsel engaged the examiner on April 4, 2026, to preserve and examine devices and accounts related to a payment of $186,450 released on March 19. Examined: the employee's company laptop, one flash drive, her company mailbox and the tenant's audit and sign-in logs, the ERP vendor change log and the bank's wire record. Not examined: the employee's personal phone, which Belmonte does not control and which is addressed in the April 8 preservation memo, and any records held by the webmail provider, the registrar or the receiving bank.

Evidence and Procedures

Each item was acquired as recorded in the acquisition record of April 6. The laptop's encrypted drive was imaged through a hardware write blocker to E01 format, with acquisition and verification SHA-256 values matching (beginning 9c41e0b7). The flash drive was imaged the same way (beginning 51be8c02). The mailbox was exported from the tenant's eDiscovery console and hashed on download (beginning e7d03f45). All analysis was performed on verified copies. Tools and versions are listed in Appendix C. The laptop's firmware clock ran 2 minutes 14 seconds slow at acquisition, and every affected time is noted. A review of the laptop's Security event log found no interactive logon between the IT manager's collection on April 3 and imaging on April 6.

Procedures followed the sequence a second examiner would need to repeat them: verification of each image, file system parsing, registry and artifact extraction, deleted file recovery by two independent methods, browser history parsing, header analysis, log export and timeline assembly. This sequence follows widely used guidance on integrating forensic techniques into investigations (Kent et al., 2006).

Findings in Detail

The browser findings (1, 7) come from the profile's History database, where visit times are stored as microseconds since 1601 in UTC. They show what the profile requested, not who was using it. The domain creation time (2) comes from public registration data captured on April 7 and saved as an exhibit with its own hash.

The flash drive and letter findings (3, 4, 5) rest on three independent records: registry entries naming the device's serial number, the shortcut file naming the volume serial number of the drive, and the recovered letter's internal metadata. The letter was recovered from the FAT32 drive both through its deleted directory entry and through a signature search of unallocated space, and both routes produced the same SHA-256 value. Its text matches the PDF attached to the March 17 message word for word.

The desktop copy (6) has standard information timestamps showing creation on February 2 and file name timestamps placing its creation on the afternoon of March 17. Ordinary tools can change the first set but not easily the second, so the February date is not reliable (Chow et al., 2007). Its content could not be recovered because the solid-state drive had erased the freed blocks.

The message findings (8, 9) rest only on the Received lines written by Belmonte's own provider. SPF, DKIM and DMARC passed for the lookalike domain, which shows that the message came from that domain and nothing more. Fourteen genuine messages from the supplier's real domain all entered from the supplier's own mail service.

The account findings (10, 11) come from the tenant's unified audit log and sign-in log, both in UTC.

Each finding is a statement about an account, a device or a file at a stated time, because that is what digital records can show, and the question of which person acted is left to the evidence that can answer it.

Alternative Explanations

Outside compromise of the account. An attacker holding the password would be expected to log in from an unrecognized network or computer, register a new authentication method, or simultaneous sessions. None was found. This explanation also does not account for findings 1, 3, 4 and 5, which were recorded on the laptop itself.

Shared credentials. If a colleague knew the password and used the laptop, the traces would look the same. The office's badge records and the employee's attendance on March 12, 13 and 17 could test this, and they are outside the examiner's scope.

Remote access. A remote-control session would leave entries for remote access software, its services and its connection logs. The examination found no remote access software installed and no remote desktop logons in the Security event log for the relevant dates.

Malware. A full scan of the mounted image with two current engines found no malicious software, and no unknown scheduled tasks or persistence entries were present. Malware cannot be excluded completely, but nothing found supports it.

Limitations

The desktop copy's content was lost to the drive's normal operation. Visits made in a private window are never written to the History database, so the report cannot speak to them. The FAT32 times rest on the laptop's Central zone setting, tested against the letter's UTC metadata. The personal phone and the third parties' records were not examined.

Opinion

The records are consistent with the letter having been created on a flash drive connected to the employee's laptop, with the lookalike domain having been bought from that laptop's browser profile, and with the redirecting message and the inbox rule having been sent and created through her accounts. The records do not show who was at the keyboard, and this report offers no opinion on any person's knowledge or intent. An expert's opinion must rest on sufficient facts and reliable methods applied reliably (Federal Rules of Evidence, 2023), and courts admitting electronic evidence ask how each item was authenticated before weighing it (Lorraine v. Markel American Insurance Co., 2007).

Appendices

Appendix A is the forty-one-row timeline from the Unit 7 reconstruction. Appendix B lists thirty-one exhibits, each with its source path, extraction method and SHA-256 value. Appendix C lists tools, versions and write blocker serial numbers.

References

Chow, K.-P., Law, F. Y. W., Kwan, M. Y. K., & Lai, P. K. Y. (2007). The rules of time on NTFS file system. Second International Workshop on Systematic Approaches to Digital Forensic Engineering, 71-85. https://doi.org/10.1109/SADFE.2007.22

Federal Rules of Evidence. (2023). Rule 702: Testimony by expert witnesses. Federal Rules of Evidence.

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86

Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007).