Digital Forensics in the Corporation A Walk Through of Risk

SMU Dept Computer Science D. Kall Loper, Ph.D. www.loperforensic.com info@loperforensic.com 817-991-6956 SMU Dept Computer Science

The Data The data for this study was drawn from 230 cases over the last 4 years. These cases were drawn from a mid-sized forensic corporation in Texas. This summary data represents cases investigated in detail. Many have been litigated to conclusion. No attempt is made to generalize these results. You will do that without my help.

Source of Cases Forensic Referral 62 Forensic Vendor 5 Law Firm 110 Individual 6 Corporation, Direct 46

How it was discovered Selling the division: A defense contractor 3 top engineers left en masse A new job: A banking executive The boss knew The IT guy did it: A transportation company Customers called The trouble with entrepreneurs… Sold the company and went into business again Nosy employees: HR data and economic harm Employees suddenly make demands

The proof Selling the division: A defense contractor Work computers reveal negotiations A new job: A banking executive Link files lead to external device The IT guy did it: A transportation company Regular contact to servers from new competitor The trouble with entrepreneurs Financial records/record fragments on computers Nosy employees: HR data and economic harm Copies of privileged documents on computers Network connection found as well

The Solutions Preserve employee’s hard disk drives. Network audit software. Restrict USB devices Restrict Webmail Backup Retention/Testing Create Policies

The Employee Love Triangle provides several illustrations of forensic techniques and integration with external counsel. Case Study

Personal Relationship IT Neckbeard HR Vice President HR Director Personal Relationship IT Director (has ABBA poster) HR Worker

The threatening letters contained information known only to HR and the executives.

The neckbeard that had been fired was considered a prime suspect by the company and the company’s IT staff. The company requested an external security audit.

Compromised Security

An examination of the IT director’s desktop computer yielded nothing. Further examination yielded several chat fragments indicating his relationship with the HR Director.

An external IP address was discovered accessing Outlook Web Access (OWA) during off hours (about 10:00pm). A subpoena served on the Internet service provider, Verizon, yielded the name of an old friend.

An interview by the VP of Human Resources and counsel with the old friend yielded the IT Director. He resigned… …and took his Abba poster with him.

Case Study Troubles with Tapes A large company is sued and compelled to produce a series of backups of E-mail during the discovery phase. Case Study

Corporate MS Exchange E-mail ~Pub.edb & ~Priv.edd logs Tape backup The Old System

Corporate MS Exchange E-mail ~Pub.edb & ~Priv.edd The New System, Actual Theoretical logs Virtual Tape Tape backup

The Risks Do you understand your backup system? Hardware? Software? Do you understand the requirements that may be placed on your company by the courts? Can you explain that you haven’t spoiled the data? Do you understand the penalties?

Definition Spoliation “The intentional destruction of evidence and when it is established, fact finder may draw inference that evidence destroyed was unfavorable to party responsible.” - Black’s Law Dictionary Definition

The Solution Be able to recover your data. Preserve Protect Policies Pay

D. Kall Loper, Ph.D. www.loperforensic.com info@loperforensic.com 817-991-6956