Digital Forensics Case Study

Computer Forensics Investigations Unit

State Police Service, Fraud and Corporate Crime Group

Digital Forensics Case Study – The Brief to our Computer Forensics Investigations unit — An Australian State police service was threatened with an attack against it’s online infrastructure and the publication of  personal identifying information of serving members. If this attack would become reality, not only would this cost many thousands of dollars, but it would also damage the department’s reputation. People would likely question the discretion, safety measures and operational skills of police members.

Our Forensics Investigations unit had to work with the limited information of the Police Service.  With only an anonymous persona and associated online account, our team was given a profiling mandate as a first step towards identifying the threat originators.

At the time of the briefing, the Police Service’s internal Cyber Crime Investigation unit had not been able to make any progress internally in over ten days.

The Digital Forensics Case Study Outcome– The Page1.me Computer Forensics Investigations unit was able to:

1. Efficiently discover the operational identities (associated aliases) and positively identify the primary participants.
2. Resolve the network framework, locations, and other identifying facts.
3. Identification of the anonymous perpetrator within three hours.
2. Map additional communications platforms and techniques used by the co-conspirators.
3. Identify a group of  malicious HACTivists, of over one thousand friends, within a hidden social networking platform that was used to secretly communicate through private messaging outside covertly. This information provided the police a lot of new intelligence and criminal leads.
4. Documentation of archived communications exchanged by the key hacker. Recovered deleted interactions, obtaining communications considered to be secret, and gathering open source public conversations.
5. Develop a walk-through cheat sheet for Police Service employees. This minimized our work to only the crucial investigation actions. This allowed a police service sworn officer to replicate our intelligence gathering and evidence preservation steps used to identify the key perpetrator, and link all relevant communications to that person. By doing so, the officer was able to testify under oath in order to obtain warrants and eventually testify before the jury.  This “walk-through” strategy meant that Page1.me investigators  did not need to go public with their techniques will reveal the nature of the engagement.