Investigation Report: Data Exfiltration from NIST Government System

Background

This investigation examines a systematic data exfiltration incident involving a government workstation at the National Institute of Standards and Technology (NIST). The primary subject, operating under the user account "informant" with email address iaman.informant@nist.gov, executed a deliberate and premeditated theft of sensitive project data using multiple removable media devices and sophisticated anti-detection techniques.

The forensic examination encompassed evidence from four primary sources: the informant-PC workstation, two USB removable media devices (rm1 labeled "Authorized USB" and rm2), and one optical media disc (CD labeled "IAMAN CD"). A total of 12 distinct evidence sources were indexed across multiple forensic tool outputs, including bulk_extractor artifacts, SleuthKit filesystem analysis, EZTools MFT and ShimCache extraction, registry hives processed through RegRipper and Python-Registry, and optical media analysis via mulder-optical. The investigation yielded 20 confirmed and inferred findings, including 2 critical, 12 high, 2 medium, and 1 low severity determinations.

The informant-PC ran Windows 7 with Microsoft Office applications, Google Chrome and Internet Explorer browsers, and various system utilities. The environment included both Google Drive and iCloud cloud storage services, though these were not utilized for the exfiltration. The source data originated from a network share at \10.11.11.128\secured_drive\Common Data, containing a folder structure labeled "Secret Project Data" with subdirectories for design documents, pricing decisions, proposals, progress tracking, and technical reviews.

Incident Timeline

The investigation established a clear chronological sequence of events spanning from March 22 through March 25, 2015, organized into distinct operational phases.

Phase 1: System Access and Privilege Establishment (March 22, 2015)

On March 22, 2015, the "informant" user account underwent automated SYSTEM-initiated privilege escalation at 14:33:54 UTC. Event logs (Event IDs 4724 and 4732) confirm that the NT AUTHORITY\SYSTEM process (SubjectLogonId 0x3e7, SID S-1-5-18) added the informant account to the local Administrators group, accompanied by a password reset. The computer account WIN-D9RGPJQ68G8$ performed these actions, indicating machine-initiated automation consistent with initial system configuration or deployment scripts.

Following this automated elevation, the user took manual action to establish redundant administrative access. Between 15:51:54 and 15:53:11 UTC, the informant account created three additional administrator accounts: admin11 (added at 15:51:54, password reset at 15:52:10), ITechTeam (added at 15:52:30, password reset at 15:52:45), and temporary (password reset at 15:53:11). All three accounts were added interactively (logon ID 0x224e3), distinguishing this manual activity from the earlier automated process. Critically, event log analysis reveals no subsequent login activity for these accounts, suggesting they served as backup access mechanisms rather than operational credentials.

Phase 2: Source Data Access and Reconnaissance (March 22-23, 2015)

Initial data access began on March 22, 2015 at 14:52:22 UTC when the user accessed the network share \10.11.11.128\secured_drive\Common Data, as documented in Registry Shellbags (usrclass.informant). This network location housed the source "Secret Project Data" folder structure that would later be exfiltrated.

On March 23, 2015, the user accessed specific project documents on the local system. Windows Recent folder LNK files corroborate two key file access events: at 18:38:21 UTC, the user opened a file matching "[secret_project]_design_concept," and at 20:27:33 UTC, accessed "[secret_project]_final_meeting.pptx." These timestamps establish direct engagement with project-related materials approximately 15 hours before the staged exfiltration on removable media.

Browser history artifacts extracted from bulk.url reveal the user conducted systematic research on data exfiltration methods during this period. Search queries included "how to leak a secret" (with access to a Microsoft Research paper "2001-leak_secret.pdf"), "data leakage methods," "leaking confidential information," "anti-forensic techniques" (ForensicsWiki page accessed), and "list of data recovery software" (Wikipedia page). A SANS whitepaper on data leakage threats and mitigation was also downloaded. The presence of these searches before the exfiltration establishes clear premeditation and contradicts any claim of coincidental or benign data handling.

Phase 3: Data Staging on Removable Media (March 24, 2015, Morning)

Registry analysis identifies two distinct SanDisk Cruzer Fit USB devices connected during the exfiltration window. Device 1 (Serial 4C530012450531101593) showed registry activity on March 23, 2015 at 18:31:10 and March 24 at 13:38:00 UTC. Device 2 (Serial 4C530012550531106501) was last written on March 24, 2015 at 13:58:33 UTC. The first device corresponds to rm1 (labeled "Authorized USB"), which contained the source "Secret Project Data" folder structure. The second device (rm2) served as the staging location.

At 09:59:27 UTC on March 24, 2015, the first masqueraded file appeared on rm2: winter_storm.amr, detected as an OLE compound document (14.5MB). Over the next 51 seconds, 16 additional files were written to rm2, completing at 10:00:18 UTC. All 17 files were placed in $OrphanFiles directories corresponding to business categories: design (2 files), PRICIN~1/pricing decision (4 files), progress (3 files), proposal (2 files), and TECHNI~1/technical review (6 files). The file naming convention used innocuous labels—winter_storm.amr, my_favorite_cars.db, super_bowl.avi, diary_#1d.txt—while the actual content comprised Office documents (Word, Excel, PowerPoint, OLE format).

File extension masquerading was systematic: documents received extensions typically associated with media (.amr, .jpg, .avi, .png, .gif, .svg), archives (.7z, .zip), databases (.db), notes (.one), or plain text (.txt). This technique exploits automatic file type detection failures common in casual inspection and automated DLP scanning. Bulk_extractor and SleuthKit file signature analysis confirmed the true file types based on magic bytes, revealing 14 distinct document instances across the 17 files, with total volume exceeding 50MB.

All files on rm2 were marked as deleted, indicating transfer to another location before the removal timestamp. The atime (access time) of 2015-03-24 00:00:00 across all files suggests they were accessed after creation, likely during transfer operations.

Phase 4: Optical Media Exfiltration (March 24, 2015, Evening)

The most significant exfiltration occurred via optical media (CD labeled "IAMAN CD") on the evening of March 24, 2015. Between 20:54:16 and 20:57:03 UTC, nine distinct burn sessions wrote and subsequently deleted the masqueraded document set.

The session sequence reveals a deliberate staging and concealment pattern. Sessions -7 through -3 (earlier sessions, numbered in reverse from the final session 0) wrote files to directories: /design/ (2 files), /pricing decision/ (4 files), /progress/ (3 files), /proposal/ (2 files), and /technical review/ (6 files). Session -1 (most recent deleted session) contained abbreviated directory names (/de, /pd, /prog, /prop, /tr) with the same files, suggesting an attempt to obscure content purpose. Session 0 (final visible state) contained only three benign JPEG images: Koala.jpg, Penguins.jpg, and Tulips.jpg—standard Windows sample images.

This nine-session progression demonstrates sophisticated anti-detection methodology. By leaving only innocuous image files visible in the final session, the perpetrator created the appearance of a casual personal media disc while the deleted burn sessions retained the exfiltrated documents in the optical media's Virtual Allocation Table (VAT) structure. Standard file browsing would reveal only the JPEG images; forensic VAT recovery was required to identify the deleted content.

Cross-system correlation confirms the identical file set appeared on both USB rm2 and optical media. Files such as winter_storm.amr (14,547,968 bytes, modified 2015-01-23T16:47:10Z) and winter_whether_advisory.zip (16,381,123 bytes, modified 2014-12-16T12:10:26Z) exhibited matching sizes and modification timestamps across both media, establishing they originated from the same source and were staged contemporaneously.

Phase 5: Post-Exfiltration Activity and Anti-Forensic Execution (March 25, 2015)

After the optical media burn completed at 20:57:03 UTC on March 24, subsequent user activity focused on obscuring forensic evidence. On March 25, 2015 at 14:50:24 UTC, Eraser 6.2.0.2962 was executed, confirmed by prefetch file creation (ERASER 6.2.0.2962.EXE-BE552234.pf). This secure deletion tool execution occurred the day after exfiltration completion.

Earlier anti-forensic tool activity preceded the exfiltration as well. CCleaner64.exe executed on March 13, 2015 at 11:10:25 UTC (nine days before staging), with language DLL activity continuing at 13:54 UTC. Eraser was initially installed on January 12, 2015 at 22:56:30-32 UTC, over two months before the incident. While the January installation and March 13 CCleaner execution could coincide with routine maintenance, the March 25 Eraser execution—immediately post-exfiltration—carries stronger temporal significance. Combined with browser history showing anti-forensic technique research, this pattern supports deliberate evidence destruction intent.

Key Findings

Premeditation and Intent

The investigation uncovered unequivocal evidence of premeditation through browser search artifacts. Prior to the data theft, the user researched specific topics including methods for leaking secrets (Microsoft Research paper "2001-leak_secret.pdf"), data leakage techniques (general search queries), a SANS whitepaper on data leakage threats and mitigation, anti-forensic techniques (ForensicsWiki), and data recovery software capabilities (Wikipedia). This research progression—from understanding how to exfiltrate data, to learning how to hide forensic traces, to understanding what forensic tools could detect—establishes deliberate planning inconsistent with spontaneous or authorized data handling.

Data Exfiltration Methodology

The perpetrator employed a multi-layered obfuscation strategy. File extension masquerading rendered 17 Office documents invisible to casual inspection by assigning media, archive, and database extensions. The directory structure used innocuous top-level folder names (design, pricing decision, proposal, progress, technical review) but were subsequently abbreviated (/de, /pd, /prop, /prog, /tr) in later sessions to reduce semantic cues. Removable media staging employed both USB (rm2 as intermediate staging, marked deleted after transfer) and optical media (final exfiltration channel with deliberate concealment via final-session JPEG overlay). The absence of cloud upload timestamps during the 09:59:27-20:57:03 UTC window, combined with available cloud storage tools, indicates deliberate preference for air-gapped removal, possibly to avoid network monitoring or preserve data sovereignty.

Privilege Escalation Context

The March 22, 2015 privilege escalation presents an interpretational challenge. The SYSTEM-initiated elevation at 14:33:54 UTC was clearly automated (SubjectLogonId 0x3e7, computer account actor), consistent with deployment scripts or Group Policy. However, the subsequent manual creation of three backup administrator accounts (admin11, ITechTeam, temporary) by the informant user between 15:51:54 and 15:53:11 UTC introduces suspicious timing. The creation of potentially redundant credentials—one already granted administrative access—followed by exfiltration activity, aligns with insider threat patterns. Critically, these accounts showed no login activity after creation, suggesting they served persistence or backup purposes rather than immediate operational needs.

This finding alone does not establish malicious privilege escalation—the automated nature of the initial elevation could indicate legitimate IT provisioning. The distinguishing factor lies in intent evidence: browser searches for data exfiltration methods combined with subsequent file staging. The privilege escalation timing relative to planned exfiltration suggests the user may have been aware of pending automated provisioning and timed activities accordingly.

Anti-Forensic Tool Deployment

Eraser installation on January 12, 2015 (two months before exfiltration), CCleaner execution on March 13, 2015 (nine days before staging), and Eraser re-execution on March 25, 2015 (day after exfiltration completion) create a suspicious temporal pattern. While CCleaner serves legitimate disk cleanup purposes and Eraser could be used for personal file deletion, the proximity to exfiltration events and browser history showing anti-forensic technique research transforms routine tool use into corroborating evidence. The January installation date could represent innocent acquisition, but the March 25 execution—post-exfiltration—suggests intentional evidence destruction.

Cross-Media Correlation

The identical file metadata across USB rm2 and optical media (matching sizes and modification timestamps for all 17 files) confirms a single source data set was staged across multiple exfiltration channels. The total exfiltration window from first USB staging (09:59:27 UTC) to final optical burn session completion (20:57:03 UTC) spans 10 hours 57 minutes 36 seconds, though actual active time was approximately 52 seconds for USB staging and 2 minutes 47 seconds for optical burning. This efficiency suggests familiarity with the data set and staging process.

Threat Intelligence and Attribution

The investigation attributes this incident to an insider threat actor with legitimate access credentials and physical system presence. Attribution confidence is high for insider status due to multiple converging factors: legitimate authentication credentials (informant account), physical access to removable media devices and optical burner, knowledge of file locations (network share navigation to specific folders), and timing consistent with business hours activity on March 22-24, 2015.

Direct attribution to a specific threat group is not supported by the evidence. No external intrusion markers, remote access tools, command-and-control infrastructure, or malware signatures were identified. The activity pattern—privilege escalation, targeted data access, and physical media exfiltration—is most consistent with trusted insider methodologies observed in cases of intellectual property theft, competitive intelligence gathering, or whistleblower activity.

The government context (NIST email domain, .gov infrastructure) and project naming convention ([secret_project] prefix) suggest potential sensitivity, though the actual classification level and content of exfiltrated documents could not be determined from forensic artifacts alone. The volume (50MB+) and systematic categorization (design, pricing, proposals, technical reviews) indicate comprehensive theft rather than opportunistic browsing.

The use of file extension masquerading and optical media concealment (JPEG overlay in final session) demonstrates awareness of inspection protocols and deliberate evasion intent. These techniques are taught in data exfiltration methodology guides and align with the browser search history indicating user research. However, the specific implementation—double extension avoidance, OLE compound document format—suggests moderate technical sophistication rather than advanced tradecraft.

Anti-forensic tool usage (Eraser, CCleaner) aligns with researcher-level awareness of disk forensics, though execution timestamps suggest imprecise timing (CCleaner nine days before, Eraser day after). More sophisticated actors would typically employ clean-up immediately post-exfiltration or use fileless techniques. The browser history showing research on data recovery software indicates the user understood forensic exposure but may not have possessed deep counter-forensic expertise.

MITRE ATT&CK techniques observed include T1036 (Masquerading), T1567.001 (Exfiltration over USB), T1052.001 (Exfiltration over removable media), T1098 (Account Manipulation), T1136.001 (Create Account), and T1078 (Valid Accounts). A total of 13 distinct MITRE ATT&CK technique identifiers were associated with findings in this case. No network-based exfiltration techniques or remote access indicators were identified.

Impact Assessment

Systems Compromised

One primary workstation (informant-PC) was confirmed to have participated in data exfiltration. Three user accounts were created for potential persistence or backup access (admin11, ITechTeam, temporary), though no post-creation usage was detected. One network file share was accessed as the data source (\10.11.11.128\secured_drive). No lateral movement beyond the initial workstation was identified, and no malware deployment, remote access tools, or persistent external access mechanisms were observed.

Data at Risk

A minimum of 17 distinct Office documents totaling over 50MB were confirmed exfiltrated. Document categories included design documents, pricing or financial materials (XLSX files disguised), proposals (large Word documents), progress tracking or status reports, and technical review materials or diaries. The largest single file, a_gift_from_you.gif (actually a Word document), measured 35.2MB, suggesting substantial content volume. Content sensitivity could not be definitively determined from forensic artifacts, though naming conventions and folder categorization suggest business-sensitive or proprietary material. The "Secret Project Data" source folder name indicates potential confidentiality expectations.

Credential Exposure

One primary user credential (informant) was involved, plus three backup administrator accounts were created (admin11, ITechTeam, temporary). Privilege escalation occurred for the primary account, though its automated nature suggests legitimate provisioning. No evidence of credential sharing, external authentication, or credential dumping was found.

Persistence Depth

Low persistence depth was observed. Backup administrative accounts were created but not subsequently used. No scheduled tasks, services, startup modifications, or registry persistence mechanisms were identified. The incident appears to have been completed and concluded within a four-day window (March 22-25, 2015) without ongoing access mechanisms.

Business Impact Assessment

The business impact hinges on the sensitivity and value of the exfiltrated data. Given the NIST context and project naming, this likely represents government research, product development, or procurement-related information. The comprehensive nature of the theft—spanning design, pricing, proposals, and technical reviews—suggests potential competitive intelligence value or whistleblower-type disclosure. Without direct content examination, impact magnitude cannot be precisely quantified, but the systematic categorization and deliberate concealment efforts suggest actor-perceived high value.

Detection Gaps

The incident exploited several organizational detection gaps: removable media policies (two USB devices connected without apparent restrictions), optical media rewrite capabilities (CD burner available for multi-session concealment), file extension inspection limitations (masqueraded files not automatically validated), network share access logging (access to \10.11.11.128\secured_drive occurred without triggering apparent alerts), and timestamp analysis (atime manipulation, modification time preservation from source files).

Immediate Tactical Containment

The following actions must be executed immediately to contain the active threat, though the incident occurred in March 2015 and the subject system may no longer be operational.

Network Isolation

1. Isolate IP address 10.11.11.128 (secured_drive file server) pending forensic review of access logs and file integrity verification for the "Secret Project Data" folder hierarchy.
2. Block outbound network traffic from any workstation matching the informant-PC hostname pattern (WIN-D9RGPJQ68G8) pending credential reset and forensic imaging.

Account Remediation

1. Disable user account "informant" (email: iaman.informant@nist.gov) across all NIST systems pending investigation completion.
2. Disable backup administrator accounts "admin11", "ITechTeam", and "temporary" on the affected workstation immediately; these accounts showed no legitimate use post-creation and represent persistence vectors.
3. Force password reset for all accounts with recent password changes on the affected system, prioritizing the informant, admin11, ITechTeam, and temporary accounts.
4. Audit Active Directory or local SAM database for similar account creation patterns across other NIST workstations.

Device Search and Forensic Preservation

1. Locate and forensically image removable media device "rm1" (labeled "Authorized USB") for source data verification; this device was the originating point for exfiltrated files.
2. Locate and forensically image removable media device "rm2" (SanDisk Cruzer Fit Serial 4C530012450531101593) if still preserved; this device contained the staged masqueraded files.
3. Locate and forensically image optical media labeled "IAMAN CD" for complete VAT recovery; this is the confirmed exfiltration destination.
4. Image the informant-PC workstation (WIN-D9RGPJQ68G8) if still operational or preserved in archive.

Malicious File Blocking (IOC Deployment)

1. Block or quarantine files matching the following masqueraded file patterns at network and endpoint boundaries: winter_storm.amr (OLE, 14.5MB), winter_whether_advisory.zip (PPTX, 16.3MB), my_favorite_cars.db (OLE, any size), new_years_day.jpg (XLSX, 10.2MB), a_gift_from_you.gif (DOCX, 35.2MB), and any "diary_#*.txt" files matching the diary_#1d, diary_#2p, etc. naming pattern.
2. Deploy file type validation tools to detect extension/content mismatches across organization endpoints.

Tool Review and Eraser Detection

1. Scan organization endpoints for Eraser 6.2.0.2962 installation (download URL: http://iweb.dl.sourceforge.net/project/eraser/.../Eraser%206.2.0.2962.exe) as potential indicator of similar activity.
2. Audit CCleaner usage logs for unusual execution timing near data access events.

Access Control Verification

1. Review network share permissions for \10.11.11.128\secured_drive to validate "informant" account authorization and implement least-privilege principles.
2. Implement access logging alerts for the "Secret Project Data" folder path if not already in place.

Strategic Remediation

The investigation identified several specific control failures that enabled this incident. Each finding below directly references evidence from this case.

Removable Media Policy Enforcement Failure

Finding Reference: Two SanDisk Cruzer Fit USB devices were connected and used for data staging without authorization checks (finding f_4fc3ca68). The presence of an "Authorized USB" label on rm1 suggests informal policy, but rm2 was unlabeled and still accessible.

Remediation: Implement endpoint DLP controls that require device registration before write access, restricting removable media to approved serial numbers with automatic blocking of unregistered devices. This would have prevented rm2 staging without blocking legitimate "Authorized USB" operations.

Optical Media Multi-Session Concealment Vulnerability

Finding Reference: The perpetrator exploited multi-session CD burning to execute a deliberate concealment technique (findings f_8ada539e, f_38ecee5d). Files written in earlier sessions were deleted in later sessions, with innocuous JPEG images left visible. Standard file browsers showed only the final session.

Remediation: Disable optical media write capabilities on workstations handling sensitive data, or deploy endpoint monitoring that logs all burn session content at the device level (not just final filesystem view). Multi-session awareness would have detected the earlier business document writes that were subsequently hidden.

File Extension Validation Gap

Finding Reference: Seventeen Office documents were renamed with false media, archive, and database extensions (finding f_ad01b9e5). The irregular extensions (.amr, .db, .svg, .one) on Office file content would have triggered immediate suspicion with active file type verification.

Remediation: Deploy endpoint and network file type validation that inspects magic bytes rather than relying on file extensions. Implement alerts for extension/content mismatches, particularly for documents with media extensions (.jpg, .gif, .avi, .amr) but Office file signatures. This single control would have flagged all 17 masqueraded files during staging.

Privileged Account Provisioning Oversight

Finding Reference: Three administrator accounts (admin11, ITechTeam, temporary) were created by the informant user on March 22, 2015 and subsequently unused (findings f_b7b336e2, f_edf1f727). The creation of redundant accounts by a newly-elevated administrator represents an anomaly that was not flagged.

Remediation: Implement real-time alerting for new administrative account creation, requiring secondary approval before activation. Enforce naming conventions that distinguish service accounts from personal accounts. Monitoring of account creation events would have immediately flagged the 15:51-15:53 UTC account creation cluster.

Network Share Access Logging Inadequacy

Finding Reference: The user accessed \10.11.11.128\secured_drive\Common Data on March 22, 2015 at 14:52:22 UTC without apparent alert generation (finding f_99d265d3). Shellbags evidence proves this access occurred, yet no real-time notification was generated for access to a folder named "Secret Project Data."

Remediation: Implement sensitivity-based access alerts for folders with keyword indicators ("secret", "confidential", "proprietary") in their names. Deploy file access auditing that generates immediate notifications for bulk access or unusual access patterns to sensitive network shares. This would have provided early warning before data staging began.

Anti-Forensic Tool Deployment Detection Failure

Finding Reference: Eraser and CCleaner were installed and executed without triggering security alerts (finding f_37022bf3). While these tools serve legitimate purposes, their presence on a workstation handling sensitive data represents elevated risk.

Remediation: Inventory and monitor secure deletion tool installation across the enterprise. Implement alerting for Eraser, CCleaner, BleachBit, and similar tool execution, with mandatory justification review for systems handling sensitive data. This would have flagged the January 12 and March 25 Eraser activations for security review.

Intent Indicator Monitoring Gap

Finding Reference: The user conducted explicit searches for "how to leak a secret," "data leakage methods," "anti-forensic techniques," and "leaking confidential information" prior to the exfiltration (finding f_b17b26d3). These searches constitute strong insider threat indicators that were not detected or acted upon.

Remediation: Deploy browser history monitoring for organizations with insider threat programs, with keyword alerting for exfiltration methodology research. Terms like "how to leak," "data exfiltration," "anti-forensic," and "whistleblower" warrant immediate security team notification in government contexts.

Conclusion

Q1. What systems were compromised?

One primary workstation (informant-PC, hostname WIN-D9RGPJQ68G8) was used to execute data exfiltration. The user accessed a network file share at \10.11.11.128\secured_drive to retrieve source data. Three additional administrator accounts were created on the local workstation but showed no evidence of use after creation. No malware deployment, lateral movement, or external intrusion was identified—this was a trusted insider event.

Q2. How did the attacker gain initial access?

Initial access was achieved through legitimate authentication credentials. The "informant" account was created on March 22, 2015 and elevated to administrator status through an automated SYSTEM process at 14:33:54 UTC. Physical access to the workstation enabled connection of USB devices and operation of the optical media burner. No external remote access or exploitation occurred.

Q3. What lateral movement occurred?

No lateral movement was detected. The investigation found no evidence of propagation beyond the initial workstation, no remote execution on other systems, and no credential dumping or pass-the-hash techniques. The user accessed a network file share, but this was data source access rather than lateral movement to compromise additional endpoints.

Q4. What persistence mechanisms were installed?

Persistence mechanisms were limited to account creation. Three administrator accounts (admin11, ITechTeam, temporary) were created as backup access vectors. However, these accounts were never used after creation, suggesting they existed as insurance rather than active persistence. No scheduled tasks, registry modifications, services, or startup items were configured for ongoing access. The incident appeared complete within a four-day window.

Q5. Was data exfiltrated, and if so, what and how much?

Yes, data exfiltration was confirmed. A minimum of 17 Office documents totaling over 50MB were staged on removable media (USB rm2) and transferred to optical media (CD labeled "IAMAN CD"). Files included Word documents (disguised as .amr, .gif, .png, .one, .txt), Excel spreadsheets (disguised as .7z, .jpg, .db), PowerPoint presentations (disguised as .zip, .txt), and OLE compound documents (disguised as .avi, .svg, .txt). Categories included design documents, pricing decisions, proposals, progress tracking, and technical reviews. Exfiltration occurred through physical removable media, not network transmission. The largest file was 35.2MB.

Q6. What is the full timeline of the incident?

The incident timeline spans March 22-25, 2015 with the following key events. On March 22, user account creation and automated privilege escalation occurred at 14:33:54 UTC, network share access began at 14:52:22 UTC, and manual creation of three backup admin accounts happened between 15:51:54 and 15:53:11 UTC. On March 23, project document access occurred with "[secret_project]_design_concept" accessed at 18:38:21 UTC and "[secret_project]_final_meeting.pptx" at 20:27:33 UTC. On March 24, USB staging executed with 17 files written to rm2 between 09:59:27 and 10:00:18 UTC, optical media burning occurred with 9 sessions written and hidden between 20:54:16 and 20:57:03 UTC, and user accessed local drive D:\pd at 20:41:22 UTC. On March 25, post-exfiltration cleanup occurred with Eraser execution at 14:50:24 UTC. Pre-incident preparation included Eraser installation on January 12, CCleaner execution on March 13, and intent indicator searches (browser history research) preceding March 22.

Q7. What is the total scope and business impact?

Scope includes one workstation used for exfiltration, one network share accessed (\10.11.11.128\secured_drive), minimum 17 documents stolen totaling over 50MB, four user accounts potentially compromised (informant, admin11, ITechTeam, temporary), and two USB devices and one optical disc used as exfiltration vectors. Business impact encompasses potential exposure of business-sensitive categories including design documents, pricing decisions, proposals, and technical reviews; NIST/government context suggests research data, procurement information, or intellectual property of scientific or economic value; deliberate concealment and premeditation indicate actor-perceived high data value; and no evidence of data return, suggesting continued exposure risk. Precise impact quantification requires examination of source document content and classification, which was beyond the forensic artifact scope.

Q8. What are the recommended remediation actions?

Remediation actions include immediate tactical containment: disable all accounts associated with the incident (informant, admin11, ITechTeam, temporary), forensically preserve and examine the optical media and USB devices, review network share logs for additional access events, implement removable media device whitelisting, deploy file type validation at endpoints, and create alerts for keyword-based suspicious research (insider threat indicator monitoring). Strategic controls to prevent recurrence include mandatory device registration for removable media write access, real-time alerting for administrative account creation, endpoint monitoring for multi-session optical burns, network share access alerts for sensitive folder keywords, anti-forensic tool execution alerts, and file extension/content mismatch detection.

This investigation confirms a deliberate, premeditated data exfiltration incident executed by a trusted insider with legitimate access. The combination of intent indicators (browser research), systematic methodology (file masquerading, multi-channel staging), and anti-forensic measures (optical session concealment, Eraser execution) establishes clear malicious purpose. The evidence affirms 14 confirmed findings and 6 inferred conclusions, supporting a coherent insider threat narrative across multiple forensic artifact sources.