Digital Forensic Fictional Review Case Study | Uncovering a Data Leak Incident

Summary

This presentation investigates a data leak at company M57, focusing on the exposure of confidential information such as salaries and Social Security numbers. The case was analyzed through digital forensics techniques, including disk imaging, evidence collection, and hash validation. The leak was traced back to a human error, where a spoofed email led an employee, Gene, to mistakenly send sensitive data to the wrong recipient. The presentation concludes with recommendations for improving email security, staff training, and implementing stronger system configurations to prevent future leaks.

Takeaways

• 😀 The data leak at company M57 involved the exposure of an Excel document containing sensitive information like salaries and Social Security numbers.
• 😀 The investigation aimed to identify the cause of the data leak and involved multiple steps including imaging the disk and using autopsy software.
• 😀 The chain of custody was maintained during the evidence collection process, with MD5 and SHA256 hashes used for file validation and security.
• 😀 The investigation process focused on analyzing the operating system, file system, applications, USB devices, internet access, and emails to trace any unauthorized access.
• 😀 The Excel file in question was found on the desktop of Gene’s machine, confirming the leaked document.
• 😀 A spoofed email address played a key role in the data leak, as Gene mistakenly sent the sensitive file to an incorrect recipient due to a miscommunication with Alison.
• 😀 The investigation revealed no evidence of hacking or external intrusion into company resources during the incident.
• 😀 The timeline of events showed various stages, including the installation of AIM, email communication issues, and the eventual discovery of the Excel file on Gene’s desktop.
• 😀 The leak was determined to be caused by human error, specifically due to the mistaken sending of the file through email with an altered sender address.
• 😀 The final recommendation emphasized securing sensitive data through encrypted methods, proper email validation training for staff, and strengthening email security using SPF, DKIM, and DMARC records.
• 😀 The investigation concluded that the information leak was preventable with better awareness of email security protocols and the use of secure file transmission methods.

Q & A

What was the primary objective of the investigation in the M57 case?

The primary objective was to investigate how confidential information, specifically an Excel document containing salaries and Social Security numbers, was exposed during the process.

What is the significance of the MD5 and SHA-256 hashes in this investigation?

MD5 and SHA-256 hashes are used to validate the integrity of the files during the collection and transport process, ensuring that no files were tampered with during the investigation.

How was the evidence collected for the investigation?

The evidence was collected by creating an image of the disk using a forensic tool, then storing it securely on a server before performing the investigation on a virtual machine.

What was the role of the autopsy software in the investigation?

Autopsy software was used to analyze and interrogate the disk image, allowing the investigator to explore the file system, detect potential issues, and gather evidence.

What was the main finding from the investigation regarding the cause of the data leak?

The data leak was caused by human error, where Gene mistakenly sent sensitive information to the wrong email address due to a spoofed email that appeared to come from Alison.

What is the importance of maintaining a chain of custody in digital forensics?

Maintaining a chain of custody is crucial to ensure the integrity and authenticity of the evidence. It documents who collected, stored, and handled the evidence to prevent tampering or contamination.

What specific email-related mistake led to the data leak?

Gene sent the Excel document to a spoofed email address that appeared to be Alison's, but it was actually directed to 'tank [email protected]', causing the leak.

What recommendations were made to prevent similar data leaks in the future?

The recommendations included securing personal information with encryption, providing staff training to recognize spoofed emails, and updating email system configurations with SPF, DMARC, and DKIM records for added protection.

What types of systems and areas were examined during the forensic investigation?

The investigation focused on the operating system, file system, installed applications, USB devices, internet access, and email communications to determine how the leak occurred.

What is the purpose of implementing SPF, DMARC, and DKIM records for email services?

SPF, DMARC, and DKIM records are designed to protect email services by verifying the authenticity of the sender’s domain, preventing spoofing and ensuring that only legitimate emails are accepted.