Investigation Dashboard
The attack timeline spans 2009-07-14 to 2015-03-25. The earliest activity was Network environment and audit policy - corporate 10.11.11.0/24 network with file server 10.11.11.128; limited audit logging enabled (2009-07-14). The investigation subsequently uncovered Sensitive Secret Project files accessed and copied to removable media (RM1/RM2). The most recent activity was Resignation letter and XPS copy created before data exfiltration (2015-03-25).
- Sensitive Secret Project files accessed and copied to removable media (RM1/RM2)
- Environment-Wide Multi-Vector Data Exfiltration Campaign Across PC and Three Removable Media
-
Sensitive Secret Project files accessed and copied to removable media (RM1/RM2)
2015-03-24T13:38:31Z — 2015-03-24T20:54:07Z
-
Environment-Wide Multi-Vector Data Exfiltration Campaign Across PC and Three Removable Media
2015-03-23T20:23:28Z — 2015-03-25T15:21:36Z
| Case ID | ndlc |
| Evidence Root | /evidence |
| Report Generated | 2026-09-19T22:15:05 |
| Investigation Start | 2026-09-19T21:17:31 |
| Investigation End | 2026-09-19T22:14:54 |
| Total Processing | 1312.6s |
| Audit Log | /home/mulder/.mulder/cases/ndlc.audit.jsonl |
Evidence Hashes
sha256sum <file>| File | SHA-256 | Size |
|---|---|---|
| cfreds_2015_data_leakage_pc.E01 | e6365e44f1004252171acb73e6779be05277cbd57d09d7febed22d2463a956a9 | 2.0 GB |
| cfreds_2015_data_leakage_rm1.E01 | a14150a21bc1e3700b51912c2ab20cd9587ad3e27ee67475af64508a7e760121 | 74.6 MB |
| cfreds_2015_data_leakage_rm2.E01 | 25215f9bcb51ceee9147886ed3f5c13ef148de634fc5114491e0f8dad8b15696 | 243.2 MB |
| cfreds_2015_data_leakage_rm3_type3.E01 | 336e1307721ef5f63679379961d1716b74f986e69df8c40117d9cea7858d512b | 90.2 MB |
Investigation Report
Investigation Report: Insider Data Exfiltration — Case NDLC
Background
This investigation concerns a suspected insider data theft incident involving a Windows 7 workstation (hostname: informant-PC, previously 37L4247F27-25) used by an employee identified as "Iaman Informant" with a NIST (National Institute of Standards and Technology) government email address (iaman.informant@nist.gov). The evidence set comprises four forensic disk images: the primary workstation (cfreds_2015_data_leakage_pc.E01), two USB flash drives (RM1 — "Authorized USB" exFAT volume, SanDisk Cruzer Fit SN 4C530012450531101593; RM2 — "IAMAN $_@" FAT32 volume, SanDisk Cruzer Fit SN 4C530012550531106501), and one optical disc (RM3 — "IAMAN CD", UDF multi-session write-once format). The investigation was conducted across 31 indexed evidence sources using 1063 tool invocations, producing 21 findings (2 critical, 11 high, 6 medium, 1 negative) mapped to 15 distinct MITRE ATT&CK techniques.
The workstation was connected to a corporate/government network segment (10.11.11.0/24) with a file server at 10.11.11.128 hosting a "secured_drive" network share containing a "Secret Project Data" folder. The system was configured with DHCP (assigned 10.11.11.129), default gateway 10.11.11.2, and DNS server 10.11.11.2. The audit policy on the system was notably limited: Object Access:File System auditing was disabled, and Process Creation auditing was also disabled, which significantly reduced the forensic trail available for reconstructing file access events.
Incident Timeline
The incident unfolded over four days, from Sunday 2015-03-22 through Wednesday 2015-03-25, and can be organized into five distinct operational phases. All timestamps below are in UTC; local time was Eastern Daylight Time (UTC-4).
Phase 1 — Account Provisioning and Environment Setup (2015-03-22): The informant user account (RID 1000) was created at 14:33:54 UTC with password hint "IAMAN" and added to the Administrators group. Within the next 80 minutes, the informant created three additional local accounts: admin11 (RID 1001, created 15:51:54, added to Administrators, password reset 15:52:10), ITechTeam (RID 1002, created 15:52:30, added to Administrators, password reset 15:52:45), and temporary (RID 1003, created 15:53:01, limited account, password reset 15:53:11). The ITechTeam account was never used (Login Count: 0, Last Login: Never), constituting a dormant backdoor. The admin11 and temporary accounts were each logged into briefly (approximately 5 and 3 minutes respectively) for what appears to be access verification testing, then abandoned. During this same day, the informant installed Internet Explorer 11 from the D:\ optical drive, Google Chrome v.41.0.2272.101, and Microsoft Office 2013.
Phase 2 — Research and Tool Acquisition (2015-03-22 to 2015-03-23): Browser history and bulk extractor URL search analysis reveal extensive premeditation. The informant searched for "how to leak a secret," "leaking confidential information," "intellectual property theft," "data leakage methods," "anti-forensic tools" (85 hits), "CD burning method" (64 hits), "DLP DRM" (90 hits), "e-mail investigation" (88 hits), "Forensic Email Investigation" (78 hits), "what is windows system artifacts" (79 hits), "external device and forensics" (65 hits), "windows event logs" (61 hits), "eraser" (51 hits), and "ccleaner" (65 hits). On 2015-03-23 at 18:17:19 UTC, the informant visited forensicswiki.org/wiki/Anti-forensic_techniques and a DEFCON-20 presentation on Anti-Forensics. Later that evening, at 19:56:04 UTC, the informant searched for "google drive," visited google.com/drive, and downloaded both Google Drive and iCloud for Windows (icloudsetup.exe at 19:56:53 UTC). Google Drive was installed at 20:02:45 UTC, with the sync folder created at C:\Users\informant\Google Drive at 20:05:32 UTC.
Phase 3 — Source Data Access (2015-03-23): At 20:23:28 UTC, Shellbags record the informant accessing the network share \10.11.11.128\secured_drive\Secret Project Data, which contained subfolders for Common Data, Past Projects, design, pricing decision, final, technical review, proposal, and progress. At 20:26 UTC, the informant opened (secret_project)_pricing_decision.xlsx in Excel. At 20:27 UTC, [secret_project]_final_meeting.pptx was opened in PowerPoint, and the V:\Secret Project Data\final folder was accessed. The informant also used Windows Search (WordWheelQuery) to search for "secret."
Phase 4 — Multi-Vector Data Exfiltration (2015-03-24): This was the most active day. At 13:38:00 UTC, the first USB device (RM1, SanDisk Cruzer Fit SN 4C530012450531101593) was connected, and Shellbags show access to E:\RM#1\Secret Project Data. The RM1 volume (labeled "Authorized USB," exFAT) contained Secret Project Data files including [secret_project]design_concept.ppt, [secret_project]_detailed_design.pptx, [secret_project]_revised_points.ppt, [secret_project]_detailed_proposal.docx, and [secret_project]_proposal.docx. At 13:58:33 UTC, the second USB device (RM2, SanDisk Cruzer Fit SN 4C530012550531106501) was connected. On RM2 (labeled "IAMAN $@," FAT32), 17 deleted files were recovered from $OrphanFiles, all created between 09:59:27 and 10:00:18 UTC, organized in folders matching the Secret Project Data structure (design, PRICIN~1, progress, proposal, TECHNI~1). Every file had a false extension: Office documents were disguised as media files (.jpg, .gif, .png, .avi, .amr, .svg, .txt, .zip, .7z, .one, .db). The volume label was changed to "IAMAN $_@" at 17:02:36 UTC. Later that evening, between 19:47 and 20:57 UTC, the informant staged and burned the "IAMAN CD" optical disc (RM3). Folders were created on D:\ with abbreviated names (de, tr, pd, prop, prog) matching Secret Project Data subfolders. The disc was burned using UDF write-once VAT format across 9 sessions, with files initially burned, then deleted and re-burned with folder name changes, ultimately leaving only 3 stock Windows sample images (Koala.jpg, Penguins.jpg, Tulips.jpg) visible in the final session while 27 Secret Project files remained in deleted sessions. All 27 files on the disc were masqueraded with false extensions.
Phase 5 — Anti-Forensic Cleanup and Departure (2015-03-25): The informant's last login was at 10:45 UTC (10 total logins). At 14:47:40 UTC, Eraser 6.2.0.2962 was downloaded from SourceForge (eraser.heidi.ie). At 14:48:28 UTC, CCleaner 5.04 was downloaded from piriform.com. Eraser.exe was executed at 15:12:28 UTC, CCleaner64.exe at 15:15:50 UTC. The event log utility wevtutil.exe was also executed (Prefetch file WEVTUTIL.EXE-400D93E8.pf created 14:54:09 UTC), consistent with event log clearing. At 15:21:30 UTC, googledrivesync.exe was launched, initiating Google Drive synchronization. At 15:24:48 UTC, WINWORD.EXE was executed to create a resignation letter (Resignation_Letter_(Iaman_Informant).docx). The XPS version was viewed at 15:28:47 UTC, and RecentDocs was updated at 15:29:08 UTC. At 15:30:09 UTC, the informant accessed My Computer, apparently checking drives before departure.
Key Findings
Data Exfiltration — Removable Media
The investigation confirmed that sensitive "Secret Project Data" files were copied from the network share \10.11.11.128\secured_drive to at least three physical media destinations. RM1 ("Authorized USB") contained Secret Project Data files in their original form. RM2 ("IAMAN $_@") contained 17 deleted files in $OrphanFiles with masqueraded extensions — Office documents renamed with media file extensions to conceal their true content. RM3 ("IAMAN CD") contained the same 17 masqueraded files plus additional deleted Secret Project files across 5 folders matching the network share structure, burned across 9 UDF sessions with a pattern of writing, deleting, and re-burning that left only innocuous stock images visible in the final session.
Data Exfiltration — Cloud Storage
Google Drive was installed on 2015-03-23 and launched on 2015-03-25 at 15:21:30 UTC. The Google Drive sync folder was created at C:\Users\informant\Google Drive. Deleted sync databases (sync_config.db-shm, snapshot.db) suggest the sync configuration was subsequently cleaned up. iCloud for Windows was also downloaded but there is no direct evidence it was used for exfiltration. The Google Drive launch on the final day, immediately after anti-forensic tool execution and immediately before resignation letter creation, strongly suggests it was used as an exfiltration channel.
Concealment — Extension Masquerading
All 27 files burned to the optical disc and all 17 deleted files on RM2 had false extensions that did not match their actual content type. ExifTool analysis confirmed every file was actually a ZIP-based Office document (docx, pptx, xlsx) or OLE compound file despite having extensions like .jpg, .png, .gif, .avi, .amr, .svg, .txt, .zip, .7z, .one, and .db. Specific examples include winter_storm.amr (actually OLE/PPT), winter_whether_advisory.zip (actually PPTX), my_favorite_cars.db (actually OLE), my_favorite_movies.7z (actually XLSX), a_gift_from_you.gif (actually DOCX, 35MB), and diary_#1d.txt through diary_#3p.txt (actually DOCX/PPTX/OLE). The diary files were actually Secret Project technical review documents. Steganography detection (stegdetect) and YARA malware scanning returned no positive results — the concealment was exclusively extension masquerading.
Sensitive Content
The masqueraded documents contained "[secret_project]" in their titles, with metadata showing Author="company" and content related to "Scientific Data Stewardship," "ISCCP Data," "NCDC processing," "Polar Imager and Sounder," "Radar Rainfall Climatology," and "NEXRAD Data Volume." One document ([secret_project]technical_review#3) was 175 pages and 36,795 words. Bulk extractor carved an email address for Eric_P._Lauer@omb.eop.gov (Office of Management and Budget, Executive Office of the President) from the winter_whether_advisory.zip file, along with Washington DC phone number 202-395-7254 (associated with OMB). URLs embedded in documents included whitehouse.gov/omb references and digitalcorpora.org/corpora/govdocs links, confirming US government-related content.
Anti-Forensic Activity
The informant downloaded and executed Eraser 6.2.0.2962 (secure deletion) and CCleaner 5.04 (system cleaning) on 2015-03-25. The event log utility wevtutil.exe was executed, consistent with event log clearing. Browser history shows prior research into anti-forensic techniques including visits to forensicswiki.org and a DEFCON-20 anti-forensics presentation. However, timestamp manipulation (timestomping) was specifically investigated and NOT detected — the timestomp detector flagged only a benign volume root artifact from image acquisition, and no user files showed evidence of timestamp manipulation.
Account Manipulation and Persistence
The informant created three additional local accounts on 2015-03-22: admin11 and ITechTeam (both added to Administrators) and temporary (limited). The ITechTeam account was never used, constituting a dormant backdoor. The admin11 and temporary accounts were briefly tested and abandoned. This pattern is consistent with establishing multiple backdoor access vectors.
Premeditation
Web search history provides overwhelming evidence of premeditation, with searches for data leakage methods, anti-forensic tools, CD burning methods, DLP/DRM, forensic investigation techniques, and evidence destruction conducted before and during the incident.
Threat Intelligence and Attribution
This incident is attributed with high confidence to an insider threat — specifically the user "Iaman Informant" who operated the workstation informant-PC with a NIST government email address (iaman.informant@nist.gov). The evidence does not suggest an external threat actor; rather, it documents a deliberate, premeditated data theft by an authorized user with legitimate access to sensitive information.
The TTP profile is consistent with a knowledgeable insider with some technical sophistication: the actor researched anti-forensic techniques before acting, used multiple redundant exfiltration channels (two USB drives, one optical disc, cloud storage), employed extension masquerading to conceal document content, used anti-forensic tools (Eraser, CCleaner, wevtutil.exe) to clean traces, and created backdoor accounts for potential future access. However, the actor's operational security had gaps: the masquerading was detectable through file signature analysis, the deleted files on RM2 were recoverable from $OrphanFiles, the multi-session UDF burning pattern on RM3 preserved deleted content, and the browser history and registry artifacts provided a comprehensive activity trail despite the cleanup attempts.
The presence of NIST and OMB-related content in the exfiltrated documents, combined with the government email address, indicates this was a government insider threat incident involving sensitive scientific and technical data. The documents' content (climate data, radar systems, satellite imagery) suggests the data may have been related to government scientific research programs.
Impact Assessment
The incident resulted in the confirmed exfiltration of sensitive "Secret Project Data" documents through at least four independent channels: two USB flash drives (RM1, RM2), one optical disc (RM3), and Google Drive cloud storage. The exfiltrated data included design documents, technical reviews (one 175 pages/36,795 words), pricing decisions, proposals, progress reports, and final meeting materials — representing a comprehensive theft of an entire project portfolio. The documents contained US government-related content including references to OMB (Office of Management and Budget) and scientific data stewardship programs.
The scope of compromise includes one workstation (informant-PC), one network share (\10.11.11.128\secured_drive), and potentially the file server at 10.11.11.128. Three backdoor accounts were created (admin11, ITechTeam, temporary), with ITechTeam remaining as a dormant administrator account. The informant's NIST government email credentials and any data accessible through that account may also be at risk. The anti-forensic cleanup (Eraser, CCleaner, wevtutil.exe) may have destroyed additional evidence of the full scope of data accessed and exfiltrated. The limited audit policy (no file system auditing, no process creation auditing) further hampered the ability to determine the complete scope of data access.
Immediate Tactical Containment
- Isolate the workstation informant-PC (10.11.11.129) from the network immediately to prevent any further data access or remote connections.
- Disable all local accounts created by the informant: admin11 (RID 1001), ITechTeam (RID 1002), and temporary (RID 1003). The ITechTeam account is a dormant administrator backdoor that must be disabled immediately.
- Disable the informant's NIST government email account (iaman.informant@nist.gov) and all associated SMTP aliases (iaman@nist.gov, iaman@mail.nist.gov, iaman@nistgov.mail.onmicrosoft.com).
- Revoke the informant's access to the network share \10.11.11.128\secured_drive and audit all access to the Secret Project Data folder on file server 10.11.11.128.
- Block Google Drive synchronization from the network perimeter and investigate whether any data was uploaded to the informant's Google Drive account. Preserve Google Drive sync logs and deleted database files (sync_config.db-shm, snapshot.db) from the workstation.
- Preserve the two USB devices (SanDisk Cruzer Fit SN 4C530012450531101593 and SN 4C530012550531106501) and the optical disc ("IAMAN CD") as evidence. Do not allow these devices to be reused or destroyed.
- Preserve the workstation's event logs immediately, as wevtutil.exe was executed and logs may have been cleared. Capture any remaining Security, System, and Application event logs before further degradation.
- Block the informant's personal Gmail (iaman.informant.personal@gmail.com) from receiving any organizational data and investigate whether it was used for exfiltration.
- Initiate recovery of the informant's Google Drive account through legal process to determine what data was uploaded.
- Notify OMB (Eric_P._Lauer@omb.eop.gov, 202-395-7254) that documents containing OMB-related content were exfiltrated, as the data may include Executive Office of the President materials.
Strategic Remediation
Root Cause 1 — Absent Data Loss Prevention (DLP) controls enabled unrestricted removable media and cloud exfiltration. The informant was able to connect two USB devices and burn an optical disc containing sensitive data without any blocking, alerting, or logging. The browser search history shows the informant specifically researched "DLP DRM" (90 hits) before acting, indicating awareness that DLP controls might be in place — and confirmation that they were not. Remediation: Deploy endpoint DLP controls that block or alert on writes to removable media containing classified or sensitive data patterns, block unauthorized cloud storage synchronization applications (Google Drive, iCloud), and alert on optical disc burning activity. This directly addresses the attack path documented in findings f_759908e2, f_3f802f8e, f_722a7716, and f_5253280b.
Root Cause 2 — Insufficient audit logging prevented detection and hampered investigation. The system's audit policy had Object Access:File System set to N (not audited) and Process Creation auditing disabled. This meant that file access to the Secret Project Data on the network share was not logged, and process execution was not recorded in event logs. The informant's research into "windows event logs" (61 hits) and "what is windows system artifacts" (79 hits) suggests awareness of logging gaps. Remediation: Enable Object Access auditing (File System, Removable Storage) and Process Creation auditing with command-line logging on all systems with access to sensitive data. Enable Audit Removable Storage policy to log USB device connections. This directly addresses the gap documented in finding f_3a4f5b73.
Root Cause 3 — Unrestricted local administrator access enabled backdoor account creation. The informant account was added to the Administrators group, which allowed creation of three additional accounts (admin11, ITechTeam, temporary) including two with administrator privileges. The ITechTeam dormant backdoor was never detected because there was no alerting on local account creation. Remediation: Implement alerting on Security event ID 4720 (account creation) and 4732 (member added to security-enabled local group), restrict local administrator group membership through Group Policy Restricted Groups, and implement LAPS (Local Administrator Password Solution) to manage local admin credentials. This directly addresses finding f_7e78eaed.
Root Cause 4 — No network access control (NAC) or removable media policy allowed unauthorized USB devices. Two personal SanDisk Cruzer Fit USB drives were connected to a government workstation and used to copy sensitive data without any device authorization or encryption requirements. Remediation: Implement a removable media policy that requires device authorization (whitelisting by serial number), enforces encryption on all removable media, and blocks unauthorized devices. The specific serial numbers 4C530012450531101593 and 4C530012550531106501 should be added to a blocklist. This directly addresses findings f_4546784e and f_759908e2.
Root Cause 5 — No user behavior analytics (UBA) or insider threat program detected anomalous activity. The informant's search history showed clear premeditation ("how to leak a secret," "anti-forensic tools," "data leakage methods") over multiple days, and the activity pattern (accessing sensitive data, connecting multiple USB devices, burning optical discs, installing cloud storage, downloading anti-forensic tools, creating a resignation letter) was highly anomalous. No alerts were generated. Remediation: Implement UBA controls that alert on combinations of: sensitive data access followed by removable media connection, anti-forensic tool downloads, cloud storage installation, and resignation letter creation. The specific search terms documented in finding f_b530a782 should be incorporated into insider threat detection rules.
Root Cause 6 — Anti-forensic tool execution was not blocked or detected. Eraser and CCleaner were downloaded from the internet and executed on a government workstation without any application whitelisting or blocking. The wevtutil.exe execution for event log clearing was similarly undetected. Remediation: Implement application whitelisting (e.g., AppLocker) to block unauthorized security/cleaning tools, and alert on execution of wevtutil.exe with clear/delete parameters. This directly addresses finding f_b9865aad.
Conclusion
Q1. What systems were compromised? One workstation (informant-PC, 10.11.11.129) was the primary system from which data was exfiltrated. The network share on file server 10.11.11.128 (\10.11.11.128\secured_drive) was the source of the stolen data. Three removable media devices (RM1 USB, RM2 USB, RM3 optical disc) received exfiltrated data. Google Drive cloud storage was used as an additional exfiltration channel.
Q2. How did the attacker gain initial access? This was an insider threat — the informant was an authorized user with legitimate access to the workstation and the network share containing Secret Project Data. No external intrusion occurred. The informant's account was created on 2015-03-22 and added to the Administrators group, providing full system access.
Q3. What lateral movement occurred? No traditional lateral movement was observed. The informant accessed the network share \10.11.11.128\secured_drive from the workstation, which was a normal network operation for an authorized user. The informant also accessed a V:\ drive containing Secret Project Data. No evidence of remote desktop, PsExec, WMI, or other lateral movement techniques to other systems was found.
Q4. What persistence mechanisms were installed? Three backdoor local accounts were created: admin11 (Administrator, briefly tested), ITechTeam (Administrator, dormant — never used), and temporary (limited, briefly tested). The ITechTeam account represents the most significant persistence mechanism as a dormant administrator backdoor with a name chosen to blend in with legitimate IT staff accounts.
Q5. Was data exfiltrated, and if so, what and how much? Yes, confirmed exfiltration of sensitive "Secret Project Data" occurred through four channels: (1) RM1 USB drive containing Secret Project files in original form; (2) RM2 USB drive containing 17 masqueraded Office documents (subsequently deleted); (3) RM3 optical disc containing 27 masqueraded Office documents across 5 folders matching the Secret Project Data structure, burned across 9 UDF sessions; (4) Google Drive cloud synchronization launched on the final day. The exfiltrated data included design documents, technical reviews (up to 175 pages/36,795 words), pricing decisions, proposals, progress reports, and final meeting materials — a comprehensive theft of an entire project portfolio containing US government-related content.
Q6. What is the full timeline of the incident? The incident spanned 2015-03-22 through 2015-03-25 (four days). Day 1 (03-22): Account creation, backdoor account provisioning, software installation (browsers, Office 2013). Day 2 (03-23): Anti-forensic research, cloud storage installation (Google Drive, iCloud), network share access, sensitive document access. Day 3 (03-24): USB device connections, data copying to RM1 and RM2, file masquerading, optical disc burning (RM3). Day 4 (03-25): Anti-forensic tool execution (Eraser, CCleaner, wevtutil.exe), Google Drive launch, resignation letter creation, final system access.
Q7. What is the total scope and business impact? The incident resulted in the theft of sensitive government scientific and technical data related to a "Secret Project" including climate data, radar systems, and satellite imagery research. The data was exfiltrated through four redundant channels, indicating the informant was determined to ensure successful removal of the data. The presence of OMB (Executive Office of the President) related content elevates the potential impact to national security. The anti-forensic cleanup may have obscured the full scope of data accessed. Three backdoor accounts remain on the system, and the informant's Google Drive account may contain additional stolen data.
Q8. What are the recommended remediation actions? Six strategic remediation actions are recommended, each addressing a specific root cause: (1) Deploy endpoint DLP to block removable media and cloud exfiltration; (2) Enable comprehensive audit logging (Object Access, Process Creation, Removable Storage); (3) Restrict local administrator access and implement account creation alerting; (4) Implement removable media device authorization and encryption policies; (5) Deploy user behavior analytics for insider threat detection; (6) Implement application whitelisting to block anti-forensic tools. Each recommendation is detailed in the Strategic Remediation section with specific references to findings and evidence from this case.
Attack Timeline
Findings
User "informant" accessed sensitive "Secret Project" files from a network share (\10.11.11.128\secured_drive\Secret Project Data) and copied them to at least two removable media devices. Shellbags show access to E:\RM#1\Secret Project Data and E:\Secret Project Data on 2015-03-24. The RM1 removable media (volume label "Authorized USB", exFAT) contained Secret Project Data files including [secret_project]design_concept.ppt, [secret_project]_detailed_design.pptx, [secret_project]_revised_points.ppt, [secret_project]_detailed_proposal.docx, and [secret_project]_proposal.docx. The RM2 removable media (volume label "IAMAN $@", FAT32) contained deleted files in $OrphanFiles with masqueraded extensions. RecentDocs shows access to [secret_project]_proposal.docx, [secret_project]_design_concept.ppt, [secret_project]_final_meeting.pptx, and (secret_project)_pricing_decision.xlsx. The user also searched for "secret" using Windows Search (WordWheelQuery).
Evidence Chain
Cross-system correlation confirms a single coordinated insider data-theft campaign by user "informant" (Iaman Informant, NIST gov email) spanning the workstation (informant-PC) and three independent removable/cloud destinations, with the SAME set of "Secret Project Data" documents converging across all of them. Independent evidence sources converge: (1) PC registry Shellbags/RecentDocs show access to the source network share \10.11.11.128\secured_drive\Secret Project Data and to E:\RM#1\Secret Project Data and E:\Secret Project Data; (2) RM1 USB ("Authorized USB", exFAT, SanDisk Cruzer Fit SN 4C530012450531101593) held Secret Project Data files; (3) RM2 USB ("IAMAN $_@", FAT32, SanDisk Cruzer Fit SN 4C530012550531106501) held 17 deleted Office documents masqueraded with media extensions in $OrphanFiles; (4) RM3 optical disc ("IAMAN CD", UDF multi-session VAT) held the SAME 17 masqueraded files plus 27 deleted Secret Project files across 5 folders matching the share structure (design, pricing decision, progress, proposal, technical review); (5) Google Drive cloud sync (googledrivesync.exe) launched 2015-03-25 15:21:30 UTC as a fourth exfiltration channel. Anti-forensic activity corroborated across sources: Eraser/CCleaner execution (ShimCache), and direct execution evidence of the event-log utility wevtutil.exe via its Prefetch file WEVTUTIL.EXE-400D93E8.pf created 2015-03-25 14:54:09 UTC (MFT), consistent with log clearing. The convergence of the identical masqueraded document set across two USB drives AND an optical disc, combined with cloud sync and anti-forensic tool execution, is more than the sum of individual artifacts and confirms deliberate, premeditated exfiltration of sensitive government (NIST/OMB-related) data through multiple redundant channels.
Evidence Chain
On the RM2 removable media (FAT32, volume label "IAMAN $@"), 17 deleted files were found in $OrphanFiles with extensions that did not match their actual content type. These were Office documents (docx, pptx, xlsx, ole) disguised as media files (jpg, gif, png, avi, amr, svg, txt, zip, 7z, one, db). Specific examples: winter_storm.amr (actually OLE/PPT), winter_whether_advisory.zip (actually PPTX), my_favorite_cars.db (actually OLE), my_favorite_movies.7z (actually XLSX), new_years_day.jpg (actually XLSX), super_bowl.avi (actually OLE), my_friends.svg (actually OLE), my_smartphone.png (actually DOCX), new_year_calendar.one (actually DOCX), a_gift_from_you.gif (actually DOCX, 35MB), landscape.png (actually DOCX), diary#1d.txt through diary_#3p.txt (actually DOCX/PPTX/OLE). All were created on RM2 on 2015-03-24 between 09:59:27 and 10:00:18 UTC. These files were subsequently deleted. The masquerading was a deliberate concealment technique to disguise sensitive documents as innocuous media files.
Merged findings:
- Data staging and deletion on removable media RM2 (IAMAN volume): The RM2 removable media (FAT32, volume label "IAMAN $@") shows evidence of data staging followed by deletion. Files were written to the device on 2015-03-24 between 09:59:27 and 10:00:18 UTC (creation times in $OrphanFiles), then subsequently deleted. The deleted files were organized in folders named: design, PRICIN~1 (pricing decision), progress, proposal, and TECHNI~1 (technical review) - matching the Secret Project Data folder structure from the network share. The files were masqueraded with false extensions. Additionally, the volume label was changed to "IAMAN $@" on 2015-03-24 17:02:36 UTC, and a desktop.ini was created at 15:51:47 UTC. The RM2 device also contained deleted image files (bmp, gif, jpg, png, tif) that appear to be stock/sample images used as cover content alongside the masqueraded documents.
Evidence Chain
User "informant" downloaded and executed anti-forensic tools to cover tracks. Eraser 6.2.0.2962 was downloaded from SourceForge (eraser.heidi.ie) on 2015-03-25 14:47:40 UTC and executed at 15:12:28 UTC. CCleaner 5.04 was downloaded from piriform.com on 2015-03-25 14:48:28 UTC and executed at 15:15:50 UTC. Browser history shows the user searched for "anti-forensic tools" on Bing and visited forensicswiki.org/wiki/Anti-forensic_techniques and a DEFCON-20 presentation on Anti-Forensics on 2015-03-23 18:17:19 UTC. ShimCache confirms execution of Eraser.exe, CCleaner64.exe, and CCleaner.exe. The user also ran wevtutil.exe (event log utility) which can be used to clear event logs.
Evidence Chain
User "informant" installed Google Drive on 2015-03-23 20:02 UTC and launched it on 2015-03-25 15:21:30 UTC. The Google Drive sync folder was created at C:\Users\informant\Google Drive (desktop.ini created 2015-03-23 20:05:32 UTC). Browser history shows the user searched for "google drive" and visited google.com/drive on 2015-03-23 19:56:04-08 UTC. iCloud for Windows was also downloaded (icloudsetup.exe) on 2015-03-23 19:56:53 UTC. The Google Drive application data shows deleted sync databases (sync_config.db-shm, snapshot.db in deleted state), suggesting the sync configuration was subsequently cleaned up. The user also had an Outlook profile configured with email iaman.informant@nist.gov (NIST government email), suggesting potential data exfiltration from a government system.
Evidence Chain
On 2015-03-22, user "informant" (RID 1000) performed extensive account manipulation: (1) Created account "admin11" (RID 1001) at 15:51:54 UTC and added it to Administrators group; (2) Created account "ITechTeam" (RID 1002) at 15:52:30 UTC and added it to Administrators group; (3) Created account "temporary" (RID 1003) at 15:53:01 UTC as a limited account; (4) Reset passwords for admin11 (15:52:10), ITechTeam (15:52:45), and temporary (15:53:11). The informant account itself was created on 2015-03-22 14:33:54 UTC with password hint "IAMAN" and was added to Administrators by WIN-D9RGPJQ68G8$ (system). The informant's password was also reset at creation time. This pattern of creating multiple admin accounts and resetting passwords is consistent with establishing backdoor access and preparing for data exfiltration activities.
Merged findings:
- ITechTeam dormant backdoor account - created with admin privileges but never used: The ITechTeam account (RID 1002) was created by user "informant" on 2015-03-22 15:52:30 UTC and added to the Administrators group. The password was reset at 15:52:45 UTC. However, the account has Login Count: 0 and Last Login Date: Never - it was never used to log into the system. This is a dormant backdoor account, created to provide persistent administrative access that could be used later without raising suspicion. The account name "ITechTeam" was likely chosen to blend in with legitimate IT staff accounts. The account was created during the same session as admin11 (15:51:54) and temporary (15:53:01), suggesting the informant was establishing multiple backdoor access vectors.
Evidence Chain
Shellbags from user "informant" show access to network share \10.11.11.128\secured_drive on 2015-03-23 20:23:28 UTC. The share contained a "Secret Project Data" folder with subfolders: Common Data, Past Projects, design, pricing decision, final, technical review, proposal, and progress. This was the source of the sensitive data that was subsequently copied to removable media. The network share was mapped/accessed before the data appeared on the removable drives. A V: drive also contained Secret Project Data (final subfolder), accessed on 2015-03-23 20:27:24 UTC.
Evidence Chain
Complete timeline of the data leakage incident in system local timezone (Eastern Standard Time, UTC-4 during March 2015 EDT):
2015-03-22 (Sunday):
- 10:33 AM EDT: informant account created, added to Administrators
- 11:51 AM EDT: admin11 account created, added to Administrators, password reset
- 11:52 AM EDT: ITechTeam account created, added to Administrators, password reset
- 11:53 AM EDT: temporary account created, password reset
- 11:11 AM EDT: IE11 installer executed from D:\ (optical drive)
- 11:12 AM EDT: Chrome installed
- 3:03 PM EDT: Office 2013 installed
2015-03-23 (Monday):
- 2:17 PM EDT: Researched anti-forensic techniques (forensicswiki.org, DEFCON-20 PDF)
- 3:56 PM EDT: Downloaded Google Drive and iCloud installers
- 4:02 PM EDT: Google Drive installed
- 4:05 PM EDT: Google Drive folder created at C:\Users\informant\Google Drive
- 4:10 PM EDT: cmd.exe executed (4 times)
- 4:23 PM EDT: Accessed network share \10.11.11.128\secured_drive\Secret Project Data
- 4:26 PM EDT: Opened (secret_project)_pricing_decision.xlsx in Excel
- 4:27 PM EDT: Opened [secret_project]_final_meeting.pptx in PowerPoint
- 4:27 PM EDT: Accessed V:\Secret Project Data\final folder
2015-03-24 (Tuesday):
- 9:38 AM EDT: Accessed E:\RM#1\Secret Project Data (USB drive RM1 connected)
- 9:59 AM EDT: Accessed E:\Secret Project Data subfolders
- 10:01 AM EDT: Opened winter_whether_advisory.zip from E:\Secret Project Data\design
- 5:59 AM EDT: Masqueraded files created on RM2 (IAMAN volume) - files written between 5:59-6:00 AM EDT
- 3:47 PM EDT: D:\ drive folders created (de, tr, pd, prop, prog) - CD/DVD burning staging
- 3:54 PM EDT: winter_whether_advisory.zip accessed on D:\de\
- 4:44 PM EDT: winter_whether_advisory.zip opened from D:\de\
- 4:54 PM EDT: Accessed E:\Secret Project Data\progress
- 1:02 PM EDT: Volume label on RM2 changed to "IAMAN $_@"
2015-03-25 (Wednesday):
- 10:45 AM EDT: informant last login (10 logins total)
- 10:47 AM EDT: Eraser 6.2.0.2962.exe downloaded and executed
- 10:48 AM EDT: ccsetup504.exe (CCleaner) downloaded and executed
- 10:50 AM EDT: Eraser installer .NET Framework setup executed
- 11:12 AM EDT: Eraser.exe executed
- 11:15 AM EDT: CCleaner64.exe executed
- 11:21 AM EDT: googledrivesync.exe launched
- 11:24 AM EDT: WINWORD.EXE executed (4 times) - resignation letter
- 11:28 AM EDT: Resignation_Letter_(Iaman_Informant).xps viewed
- 11:29 AM EDT: RecentDocs updated with Resignation_Letter_(Iaman_Informant).docx
- 11:30 AM EDT: My Computer accessed (checking drives)
Evidence Chain
RecentDocs shows access to "BD-RE Drive (D:) IAMAN CD" and "BD-RE Drive (D:)" on 2015-03-24, indicating the user burned a Blu-ray RE writable disc labeled "IAMAN CD". Shellbags show folders created on D:\ drive (de, tr, pd, prop, prog) on 2015-03-24 19:47-20:41 UTC, which are abbreviated folder names matching Secret Project Data subfolders (de=design, tr=technical review, pd=pricing decision, prop=proposal, prog=progress). The winter_whether_advisory.zip file was accessed on D:\de\ at 19:54:43 UTC. The ShimCache also shows IE11 installer was present on D:\ drive. This represents a third exfiltration vector beyond the USB drives and cloud storage.
Evidence Chain
Every single file burned to the "IAMAN CD" optical disc has a false extension that does not match its actual content type. ExifTool analysis reveals all files are actually ZIP-based Office documents (docx, pptx, xlsx) or OLE compound files, despite having extensions like .jpg, .png, .gif, .avi, .amr, .svg, .txt, .zip, .7z, .one, and .db. Specific masquerading: winter_storm.amr (OLE/PPT), winter_whether_advisory.zip (PPTX), my_favorite_cars.db (OLE), my_favorite_movies.7z (XLSX), new_years_day.jpg (XLSX), super_bowl.avi (OLE), my_friends.svg (OLE), my_smartphone.png (DOCX), new_year_calendar.one (DOCX), a_gift_from_you.gif (DOCX, 35MB), landscape.png (DOCX), diary_#1d.txt through diary_#3p.txt (DOCX/PPTX/OLE). The diary files are actually Secret Project technical review documents. This is a deliberate concealment technique to disguise sensitive documents as innocuous media files.
Evidence Chain
The masqueraded files on the optical disc are Microsoft Office documents containing "[secret_project]" in their titles. Metadata analysis reveals: diary_#1p.txt and diary_#3p.txt are PowerPoint presentations titled "[secret_project]technical_review#3" and "[secret_project]technical_review#2"; diary_#3d.txt is a Word document titled "[secret_project]technical_review#3" with 175 pages and 36,795 words. All documents have Author="company", Last Modified By="company", and Current User="company". The PowerPoint files contain embedded content about "Scientific Data Stewardship", "ISCCP Data", "NCDC processing", "Polar Imager and Sounder", "Radar Rainfall Climatology", and "NEXRAD Data Volume" - suggesting government/scientific data. The documents contain hyperlinks to digitalcorpora.org/corpora/govdocs and hdl.loc.gov. Create dates range from 2001-2003 (original templates) with modify dates in January 2015, indicating these are legitimate sensitive documents that were copied and disguised.
Evidence Chain
The RM3 optical disc (volume label "IAMAN CD", UDF write-once with VAT) contains 9 sessions showing a pattern of file writing and deletion. The disc contains:
- 3 cover images (Koala.jpg, Penguins.jpg, Tulips.jpg) - standard Windows sample images used as decoys
- 5 folders matching Secret Project Data structure: design, pricing decision, progress, proposal, technical review
- 17 masqueraded files (same as RM2) with false extensions hiding Office documents
- Files were written in session 0, then deleted in subsequent sessions (sessions -1 through -7)
- The UDF VAT (Virtual Allocation Table) shows 9 generations, indicating the disc was written multiple times with files being added and removed
- ExifTool confirms the masqueraded files are actually Office documents (ZIP/DOCX/PPT/DOC format)
- The PPT files have titles confirming Secret Project content: "[secret_project]technical_review#3" and "[secret_project]technical_review#2"
- The DOC file is "[secret_project]technical_review#3" - 175 pages, 36,795 words
- The disc was created on 2015-03-24 between 20:54:16 and 20:57:03 UTC
- This represents a third exfiltration vector beyond the USB drives (RM1, RM2) and cloud storage (Google Drive)
Merged findings:
- Optical disc "IAMAN CD" contains 9 burn sessions with deleted Secret Project files: The rm3 optical disc (UDF write-once VAT format, volume label "IAMAN CD", 52,513 sectors) contains 9 sessions (VAT generations) showing a pattern of burning, deleting, and re-burning files. The disc contains 3 present image files (Koala.jpg, Penguins.jpg, Tulips.jpg - stock Windows sample images from 2008-2009) and 27 deleted files across 5 directories matching Secret Project Data folder names: /design (de), /pricing decision (pd), /progress (prog), /proposal (prop), /technical review (tr). All deleted files were created on 2015-03-24 between 20:54:16 and 20:55:46 UTC. The files were initially burned with full directory names (session 0), then deleted and re-burned with abbreviated names (sessions -1 through -7), suggesting an attempt to obscure the content or fit within naming constraints.
- Multi-session burning pattern shows deliberate file management on optical disc: The "IAMAN CD" optical disc uses UDF write-once VAT (Virtual Allocation Table) format with 9 sessions, showing a sophisticated burning pattern. Session 0 (the final visible session) contains only 3 stock image files (Koala.jpg, Penguins.jpg, Tulips.jpg) and 10 deleted directory entries. Sessions -1 through -7 contain the actual Secret Project files, organized in folders with abbreviated names (de, pd, prog, prop, tr) that were later renamed to full names (design, pricing decision, progress, proposal, technical review). This pattern indicates: (1) Files were initially burned with abbreviated folder names; (2) Multiple burn sessions were used to add files incrementally; (3) Folder names were changed between sessions; (4) All sensitive files were marked as deleted in the final session, leaving only innocuous stock images visible. This is consistent with an attempt to create a disc that appears to contain only personal photos while actually containing hidden sensitive documents.
Evidence Chain
Bulk extractor URL search history from the PC shows the user conducted extensive research before and during the data leakage incident, demonstrating clear premeditation. Key searches include:
- "how to leak a secret" (multiple variations)
- "leaking confidential information"
- "intellectual property theft"
- "data leakage methods"
- "information leakage cases"
- "anti-forensic tools" (85 hits)
- "anti-forensics" (multiple variations)
- "CD burning method" (64 hits) and "CD burning method in windows" (53 hits)
- "how to delete data" (multiple variations)
- "data recovery tools" (multiple variations)
- "cloud storage" (multiple variations)
- "system cleaner" (multiple variations)
- "security checkpoint cd-r"
- "DLP DRM" (90 hits) - Data Loss Prevention
- "e-mail investigation" (88 hits)
- "Forensic Email Investigation" (78 hits)
- "what is windows system artifacts" (79 hits)
- "external device and forensics" (65 hits)
- "investigation on windows machine" (64 hits)
- "windows event logs" (61 hits)
- "eraser" (51 hits)
- "ccleaner" (65 hits)
- "google drive" (10 hits)
- "apple icloud"
- "outlook 2013 settings"
- "file sharing and tethering" (491 hits)
- "digital forensics" (1 hit)
These searches show the user was researching how to leak data, cover their tracks, and understand forensic investigation techniques before executing the data theft.
Merged findings:
- Extensive research into data leakage, anti-forensics, and evidence destruction techniques: Bulk extractor URL search histogram from the main disk (cfreds_2015_data_leakage_pc.E01) reveals the user conducted extensive research into data leakage and anti-forensic techniques. Search queries found in browser data include: "anti-forensic tools" (85 hits), "ccleaner" (65 hits), "eraser" (51 hits), "cd burning method" (64 hits), "cd burning method in windows" (53 hits), "windows event logs" (61 hits), "DLP DRM" (90 hits), "e-mail investigation" (88 hits), "Forensic Email Investigation" (78 hits), "external device and forensics" (65 hits), "investigation on windows machine" (64 hits), "what is windows system artifacts" (79 hits), "information leakage cases" (47 hits), "leaking confidential information" (2 hits), "how to leak a secret" (6 hits), "intellectual property theft" (6 hits), "cloud storage" (6 hits), "how to delete data" (5 hits), "system cleaner" (5 hits), "data recovery tools" (3 hits), "digital forensics" (1 hit), "data leakage methods" (1 hit), "security checkpoint cd-r" (1 hit), "file sharing and tethering" (491 hits), "google drive" (10 hits), "apple icloud" (1 hit), and "outlook 2013 settings" (1 hit). These searches demonstrate premeditation and deliberate planning for data exfiltration and evidence destruction.
Evidence Chain
User "informant" created a resignation letter (Resignation_Letter_(Iaman_Informant).docx) and saved it as both DOCX and XPS format on 2015-03-25. The document appears in RecentDocs with LastWrite 2015-03-25 15:29:08 UTC, and in OpenSavePidlMRU showing it was saved via WINWORD.EXE. The XPS version was viewed with xpsrchvw.exe at 15:28:47 UTC. This indicates the user was preparing to leave the organization, which is a common precursor to insider data theft. The resignation letter was created on the same day as the anti-forensic tool execution (Eraser at 15:12:28, CCleaner at 15:15:50) and Google Drive launch (15:21:30), suggesting a coordinated sequence of: resign → clean traces → exfiltrate via cloud → leave.
Evidence Chain
Bulk extractor analysis of the rm3 optical disc ("IAMAN CD") carved the following IOCs: (1) Email: Eric_P._Lauer@omb.eop.gov (Office of Management and Budget, Executive Office of the President) - found in the winter_whether_advisory.zip file which is actually a PowerPoint presentation; (2) Telephone numbers: 202-395-7254 (Washington DC area code, associated with OMB), (760) 413-4114 (California), 206-526-6653 (Seattle WA); (3) URLs embedded in documents: http://www.iec.ch (International Electrotechnical Commission), http://www.whitehouse.gov/omb/egov/documents/FEA_CRM_v23_Final_Oct_2007.pdf, http://www.whitehouse.gov/omb/circulars/a11/current_year/s53.pdf, http://digitalcorpora.org/corpora/govdocs, http://hdl.loc.gov/loc.pnp/acd.2a10339, plus numerous Microsoft schema URLs from Office document XML. The presence of OMB (White House) email and URLs confirms the documents contain US government-related content. The digitalcorpora.org URLs are from the GovDocs corpus, suggesting these may be reference documents embedded within the Secret Project files.
Evidence Chain
Registry USBSTOR key shows two SanDisk Cruzer Fit USB devices were connected to the system:
1. Serial number 4C530012450531101593 (last written 2015-03-24 13:38:00 UTC) - This corresponds to RM1 ("Authorized USB" volume label)
2. Serial number 4C530012550531106501 (last written 2015-03-24 13:58:33 UTC) - This corresponds to RM2 ("IAMAN $_@" volume label)
Both devices are SanDisk Cruzer Fit USB flash drives (Rev 2.01). The first device was last connected on 2015-03-24 at 13:38:00 UTC, and the second on 2015-03-24 at 13:58:33 UTC. These timestamps align with the Shellbags evidence showing access to E:\RM#1\Secret Project Data and E:\Secret Project Data on 2015-03-24. The USBSTOR key was last written on 2015-03-23 18:31:10 UTC, indicating the first USB device was connected on that date.
Evidence Chain
Registry analysis of the SYSTEM hive shows the network interface was configured with DHCP enabled and received an IP address on the 10.11.11.x subnet (DhcpIPAddress = 10.11.11.x, truncated in output). The network share accessed by the user (\10.11.11.128\secured_drive) was on the same subnet, indicating the system was on a corporate/internal network. The LastLoggedOnUser was .\informant (informant-PC\informant), confirming the informant account was the last user logged in before the system was imaged. The system hostname was informant-PC (previously 37L4247F27-25 before renaming). The audit policy from the Security hive shows limited logging was enabled - Object Access:File System was set to N (not audited), meaning file access to the Secret Project Data was not being logged. Process Creation auditing was also disabled (N). This limited audit policy may have facilitated the data theft by reducing the forensic trail.
Network environment detail (merged from f_99232d8a): The system was connected to a corporate network with IP Address 10.11.11.129 (DHCP assigned), Subnet Mask 255.255.255.0, Default Gateway 10.11.11.2, DNS Server 10.11.11.2, DHCP Server 10.11.11.254, Domain localdomain. File Server 10.11.11.128 hosted the secured_drive share with Secret Project Data. Timezone: Eastern Standard Time (UTC-5, EDT UTC-4 during March 2015). DHCP Lease obtained 2015-03-25 10:33:18 UTC (LeaseObtainedTime 1427296790). The network interface {E2B9AEEC-B1F7-4778-A049-50D7F2DAB2DE} was the active connection. This was a corporate/government network environment, consistent with the NIST email addresses found on the system.
Evidence Chain
Registry software hive shows the following software was installed on the system during the incident timeframe:
- 2015-03-22 15:11:51 UTC: Google Chrome v.41.0.2272.101 installed
- 2015-03-22 15:16:03 UTC: Google Update Helper v.1.3.26.9 installed
- 2015-03-22 15:01:02 UTC: Microsoft Office 2013 (Excel, Access, etc.) installed
- 2015-03-23 20:00:45 UTC: Apple Application Support v.3.0.6 installed (part of iCloud installation)
- 2015-03-23 20:01:01 UTC: Apple Software Update v.2.1.3.127 installed (part of iCloud installation)
- 2015-03-23 20:00:56 UTC: Bonjour Service installed (part of iCloud installation, runs as mDNSResponder.exe)
- 2015-03-23 20:02:45 UTC: Google Drive installed (googledrivesync64.dll registered)
The installation timeline shows the user installed browsers (Chrome), cloud storage (Google Drive, iCloud), and productivity software (Office 2013) in preparation for the data leakage. The iCloud installation (Apple Application Support, Apple Software Update, Bonjour) was downloaded on 2015-03-23 19:56:53 UTC and installed around 20:00-20:01 UTC, just before the network share access at 20:23 UTC.
Evidence Chain
The admin11 and temporary accounts created by informant show brief usage patterns consistent with testing the accounts before abandoning them:
admin11 (RID 1001):
- Created 2015-03-22 15:51:54 UTC, added to Administrators
- Logged in twice (Login Count: 2), last login 2015-03-22 15:57:02 UTC
- UserAssist shows: NOTEPAD.EXE (1 run), explorer.exe (1 run), Chrome (1 run)
- RecentDocs shows access to setupapi.dev.log and inf folder
- Shellbags show navigation to C:\Windows\inf\ServiceModelEndpoint 3.0.0.0
- TypedURLs shows only the default IE first-run URL
- No WordWheelQuery searches, no ComDlg32 history
- Activity lasted approximately 5 minutes (15:52-15:57)
temporary (RID 1003):
- Created 2015-03-22 15:53:01 UTC as limited account
- Logged in once (Login Count: 1), last login 2015-03-22 15:55:57 UTC
- UserAssist shows: explorer.exe (1 run)
- Shellbags show navigation to C:\Users\temporary\Downloads and Control Panel\User Accounts\Change Your Password
- TypedURLs shows only the default IE first-run URL
- No RecentDocs, no WordWheelQuery searches
- Activity lasted approximately 3 minutes (15:54-15:57)
Both accounts were used briefly and then abandoned. The admin11 account was used to check system setup files (setupapi.dev.log, inf folder), possibly to verify the account had proper admin access. The temporary account was used to access User Accounts control panel, possibly to verify password change functionality. Neither account was used for any data access or exfiltration activities.
Evidence Chain
The primary user of the PC is "informant" (Iaman Informant), with Windows account created 2015-03-22 14:33:54 UTC and password hint "IAMAN". The user had an Outlook profile configured with government email iaman.informant@nist.gov (NIST - National Institute of Standards and Technology), with SMTP addresses iaman@nist.gov, iaman@mail.nist.gov, and iaman@nistgov.mail.onmicrosoft.com. A personal Gmail account was also found: iaman.informant.personal@gmail.com. The user also had cookies from eraser.heidi.ie (informant@heidi.ie) and sourceforge.net (informant@sourceforge.net), linking the user to the anti-forensic tool downloads. The email addresses and Outlook OST file confirm this was a government workstation used by an insider who leaked sensitive data.
Evidence Chain
Steganography detection (stegdetect) and YARA malware scanning of all extracted files from the rm3 optical disc returned no positive results. The concealment technique used was exclusively extension masquerading (renaming Office documents with media file extensions) rather than steganographic embedding or malware. The three present image files (Koala.jpg, Penguins.jpg, Tulips.jpg) are legitimate Windows sample images with valid JPEG signatures and Corbis/Microsoft copyright metadata from 2008-2009, likely included as cover content to make the disc appear to contain only innocuous photos.
Evidence Chain
These hypotheses were explicitly tested and no supporting evidence was found.
-
No timestamp manipulation (timestomping) detected on user files
Click to expand
MITRE ATT&CK Coverage
Indicators of Compromise
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
| Internal IP | 10.11.11.128 |
Sensitive Secret Project files accessed and copied to removable media (RM1/RM2) | VT | |
| Internal IP | 10.11.11.129 |
Network environment and audit policy - corporate 10.11.11.0/24 network with file | VT | |
| Internal IP | 10.11.11.2 |
Network environment and audit policy - corporate 10.11.11.0/24 network with file | VT | |
| Internal IP | 10.11.11.254 |
Network environment and audit policy - corporate 10.11.11.0/24 network with file | VT | |
| External IP | 1.3.26.9 |
Installed software timeline - browsers, cloud storage, and anti-forensic tools | VT | |
| External IP | 2.1.3.127 |
Installed software timeline - browsers, cloud storage, and anti-forensic tools | VT | |
| External IP | 3.0.0.0 |
Secondary backdoor accounts show brief usage patterns consistent with testing | VT |
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
| Path | C:\Users\informant\Google |
Google Drive cloud storage installed and used for potential data exfiltration | ||
| Path | C:\Windows\inf\ServiceModelEndpoint |
Secondary backdoor accounts show brief usage patterns consistent with testing | ||
| Path | C:\Users\temporary\Downloads |
Secondary backdoor accounts show brief usage patterns consistent with testing |
| Type | Value | Enrichment | Context | Actions |
|---|---|---|---|---|
iaman.informant@nist.gov |
Google Drive cloud storage installed and used for potential data exfiltration | |||
eric_p._lauer@omb.eop.gov |
IOCs carved from optical disc reveal government email and reference URLs |
Evidence Browser
Evidence Sources
| Source Name | Extractor | Lines | Hash | Referenced By |
|---|---|---|---|---|
| tsk.partitions | sleuthkit | 10 | blake2b:67b9085f... |
— |
| tsk.filelist | sleuthkit | 104709 | blake2b:171e0914... |
2 findings |
| tsk.filelist.p1 | sleuthkit | 93 | blake2b:5bdfadd3... |
2 findings |
| tsk.partitions | sleuthkit | 9 | blake2b:83c0b87c... |
— |
| tsk.fsstat | sleuthkit | 40 | blake2b:9e253812... |
2 findings |
| tsk.timeline | sleuthkit | 187 | blake2b:da03c607... |
2 findings |
| tsk.partitions | sleuthkit | 8 | blake2b:3eed10c8... |
— |
| tsk.fsstat | sleuthkit | 37 | blake2b:2d2079ee... |
2 findings |
| tsk.masquerade | sleuthkit | 17 | blake2b:97440a18... |
4 findings |
| tsk.timeline | sleuthkit | 67 | blake2b:822b5179... |
2 findings |
| tsk.filelist | sleuthkit | 27 | blake2b:ae86d6dd... |
2 findings |
| tsk.masquerade | sleuthkit | 0 | blake2b:empty... |
4 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:a4dc6e64... |
— |
| bulk.domain | bulk_extractor | 264 | blake2b:c8b97b94... |
3 findings |
| bulk.duplicates | bulk_extractor | 9 | blake2b:9ba9de0c... |
— |
| bulk.email | bulk_extractor | 43 | blake2b:eb085c00... |
2 findings |
| bulk.rfc822 | bulk_extractor | 41 | blake2b:283d0ef9... |
— |
| bulk.url | bulk_extractor | 288 | blake2b:d727c498... |
2 findings |
| bulk.url_services | bulk_extractor | 19 | blake2b:01e609ea... |
2 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:c1cbc2f5... |
— |
| bulk.domain | bulk_extractor | 189 | blake2b:ae916b75... |
3 findings |
| bulk.duplicates | bulk_extractor | 9 | blake2b:bb406faf... |
— |
| bulk.url | bulk_extractor | 207 | blake2b:039de0b6... |
2 findings |
| bulk.url_services | bulk_extractor | 14 | blake2b:2eac1377... |
2 findings |
| strings.output | strings | 22065 | blake2b:9705a003... |
— |
| tsk.filelist | sleuthkit | 51 | blake2b:55fc9962... |
2 findings |
| browser.history | browser_parser | 251 | blake2b:cd3faccf... |
2 findings |
| browser.history | browser_parser | 251 | blake2b:cd3faccf... |
2 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:1fc22830... |
— |
| bulk.domain | bulk_extractor | 366963 | blake2b:bf691b18... |
3 findings |
| bulk.duplicates | bulk_extractor | 12 | blake2b:f8b9f6c0... |
— |
| bulk.email | bulk_extractor | 6851 | blake2b:852590c3... |
2 findings |
| bulk.ether | bulk_extractor | 6 | blake2b:0825117f... |
— |
| bulk.rfc822 | bulk_extractor | 7326 | blake2b:218e7e6e... |
— |
| bulk.url | bulk_extractor | 421750 | blake2b:ca116b29... |
2 findings |
| exiftool.metadata | exiftool | 9 | blake2b:86bef5ec... |
5 findings |
| bulk.url_facebook-address | bulk_extractor | 19 | blake2b:7fe55073... |
2 findings |
| bulk.url_searches | bulk_extractor | 155 | blake2b:b928562c... |
3 findings |
| bulk.url_services | bulk_extractor | 3637 | blake2b:c01e89c3... |
2 findings |
| tsk.masquerade | sleuthkit | 3 | blake2b:42bb5e7d... |
4 findings |
| ez.mft | eztools | 98918 | blake2b:685e21c6... |
2 findings |
| evtx.manifest | evtx-extract | 54 | blake2b:62bd3681... |
— |
| registry.query.system | python-registry | 1 | blake2b:8639046c... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:8b59c9a0... |
1 finding |
| ez.shimcache | eztools | 307 | blake2b:a2eee012... |
5 findings |
| browser.history | browser_parser | 251 | blake2b:cd3faccf... |
2 findings |
| registry.sam | regripper | 186 | blake2b:9c899172... |
4 findings |
| registry.sam | regripper | 7 | blake2b:e4c6f012... |
4 findings |
| registry.sam | regripper | 7 | blake2b:e4c6f012... |
4 findings |
| registry.security | regripper | 69 | blake2b:6b7bf22c... |
1 finding |
| registry.security | regripper | 8 | blake2b:3c5e87f4... |
1 finding |
| registry.software | regripper | 33492 | blake2b:550fd06d... |
2 findings |
| registry.software | regripper | 283 | blake2b:81548a67... |
2 findings |
| registry.software | regripper | 283 | blake2b:f1614a1d... |
2 findings |
| registry.system | regripper | 5209 | blake2b:f9a568e4... |
4 findings |
| registry.system | regripper | 199 | blake2b:bd03d827... |
4 findings |
| registry.system | regripper | 199 | blake2b:a49fdc26... |
4 findings |
| registry.system | regripper | 381 | blake2b:070a4d56... |
4 findings |
| registry.system | regripper | 255 | blake2b:0d77cf74... |
4 findings |
| registry.system | regripper | 255 | blake2b:0d77cf74... |
4 findings |
| registry.usrclass.admin11 | regripper | 11 | blake2b:26a43778... |
1 finding |
| registry.ntuser.admin11 | regripper | 133 | blake2b:bf617a09... |
1 finding |
| registry.ntuser.default | regripper | 74 | blake2b:8518dc3f... |
— |
| registry.usrclass.informant | regripper | 102 | blake2b:9f1344c3... |
5 findings |
| registry.ntuser.informant | regripper | 306 | blake2b:597d71cd... |
6 findings |
| registry.usrclass.temporary | regripper | 15 | blake2b:3ef5eb22... |
1 finding |
| registry.ntuser.temporary | regripper | 118 | blake2b:800424ee... |
1 finding |
| hayabusa.alerts | hayabusa | 35 | blake2b:b2987383... |
2 findings |
| optical.listing | mulder-optical | 58 | blake2b:65ca19c0... |
2 findings |
| bulk.bulk_extractor | bulk_extractor | 1 | blake2b:977ed693... |
— |
| bulk.domain | bulk_extractor | 237 | blake2b:29444e46... |
3 findings |
| bulk.email | bulk_extractor | 12 | blake2b:26c081a6... |
2 findings |
| bulk.rfc822 | bulk_extractor | 41 | blake2b:e3da4d10... |
— |
| bulk.telephone | bulk_extractor | 8 | blake2b:df6bad84... |
1 finding |
| bulk.url | bulk_extractor | 300 | blake2b:28d82359... |
2 findings |
| bulk.url_services | bulk_extractor | 21 | blake2b:6224c8f2... |
2 findings |
| hashdeep.hashes | hashdeep | 32 | blake2b:1aa05e03... |
1 finding |
| exiftool.metadata | exiftool | 770 | blake2b:d09e539b... |
5 findings |
| registry.query.system | python-registry | 1 | blake2b:8639046c... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:651ecc03... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:dc94c4ac... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:76eecd6f... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:3ab1cb9e... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:106b833a... |
1 finding |
| registry.query.system | python-registry | 1 | blake2b:9f595401... |
1 finding |
| browser.history | browser_parser | 251 | blake2b:cd3faccf... |
2 findings |
| composite.file_staging | composite | 578 | blake2b:fd48ce21... |
— |
| forensic.timestomping | timestomp_detector | 1 | blake2b:a8aad413... |
1 finding |
| composite.timeline | composite | 172 | blake2b:891896e2... |
— |
| composite.execution | composite | 122 | blake2b:01835347... |
— |
| composite.defense_evasion | composite | 163 | blake2b:d07b5524... |
1 finding |
| enrichment.iocs | enrichment | 67 | blake2b:18ba0733... |
— |
| composite.lateral_movement | composite | 379 | blake2b:2eddca82... |
— |
| composite.correlation | composite | 1 | blake2b:1655978f... |
— |
| composite.correlation | composite | 1 | blake2b:1655978f... |
— |
| composite.correlation | composite | 1 | blake2b:1655978f... |
— |
| composite.correlation | composite | 1 | blake2b:0fb97180... |
— |
| composite.persistence | composite | 2418 | blake2b:d4070237... |
— |
| forensic.timestomping | timestomp_detector | 1 | blake2b:a8aad413... |
1 finding |
| composite.file_staging | composite | 578 | blake2b:fd48ce21... |
— |
| composite.exfil | composite | 2516 | blake2b:bd7c42d9... |
— |
| composite.correlation | composite | 1 | blake2b:57a33b7e... |
— |
| composite.exfil | composite | 2522 | blake2b:432946b9... |
— |
| composite.defense_evasion | composite | 160 | blake2b:90a3a1e4... |
1 finding |
| composite.execution | composite | 122 | blake2b:01835347... |
— |
| composite.timeline | composite | 172 | blake2b:891896e2... |
— |
| composite.file_staging | composite | 578 | blake2b:fd48ce21... |
— |
| composite.persistence | composite | 2413 | blake2b:b4b5533c... |
— |
| composite.lateral_movement | composite | 472 | blake2b:203af37a... |
— |
| forensic.timestomping | timestomp_detector | 1 | blake2b:a8aad413... |
1 finding |
| composite.correlation | composite | 1 | blake2b:366dfe9b... |
— |
| enrichment.iocs | enrichment | 67 | blake2b:8f65bf29... |
— |
| composite.correlation | composite | 1 | blake2b:fc319a35... |
— |
| composite.correlation | composite | 1 | blake2b:fc319a35... |
— |
| composite.correlation | composite | 1 | blake2b:fc319a35... |
— |
| composite.correlation | composite | 1 | blake2b:fc319a35... |
— |
| forensic.timestomping | timestomp_detector | 1 | blake2b:a8aad413... |
1 finding |
Investigation Performance
| Input Tokens | 4,067 |
| Output Tokens | 163,359 |
| Total Tokens | 167,426 |
| Per-Model Breakdown | |
| bedrock/us.moonshotai.kimi-k3 | 167,426 |
Audit Trail
| ID | Tool | Duration | Timestamp | Actions |
|---|---|---|---|---|
| tc_70a127c0 | scan_evidence | 2039ms | 2026-09-19T21:17:31 | |
| tc_3f45af4a | list_directory | 2ms | 2026-09-19T21:17:32 | |
| tc_c535d4fe | list_sources | 1ms | 2026-09-19T21:17:32 | |
| tc_d1100171 | get_source_stats | 2ms | 2026-09-19T21:17:33 | |
| tc_9c11a5a4 | open_case | 28ms | 2026-09-19T21:17:40 | |
| tc_fcdb678c | open_case | 29ms | 2026-09-19T21:17:43 | |
| tc_b89da70f | open_case | 29ms | 2026-09-19T21:17:45 | |
| tc_c325150b | open_case | 28ms | 2026-09-19T21:18:09 | |
| tc_bc98735f | start_extraction_batch | 7ms | 2026-09-19T21:18:10 | |
| tc_b7d9d8c5 | run_mmls | 46ms | 2026-09-19T21:18:10 | |
| tc_f6ecd42e | run_fls | 10264ms | 2026-09-19T21:18:21 | |
| tc_ce93b1e3 | open_case | 44ms | 2026-09-19T21:18:25 | |
| tc_c5897258 | run_mmls | 47ms | 2026-09-19T21:18:28 | |
| tc_06a202f9 | run_fsstat | 97ms | 2026-09-19T21:18:28 | |
| tc_104713ca | start_extraction_batch | 7ms | 2026-09-19T21:18:28 | |
| tc_64aef97f | open_case | 81ms | 2026-09-19T21:18:29 | |
| tc_0f4ee891 | run_mactime | 1690ms | 2026-09-19T21:18:30 | |
| tc_6e4645d1 | run_mmls | 57ms | 2026-09-19T21:18:31 | |
| tc_614a2276 | run_fsstat | 99ms | 2026-09-19T21:18:31 | |
| tc_091fe1a9 | detect_masquerading | 3326ms | 2026-09-19T21:18:31 | |
| tc_09a6090b | start_extraction_batch | 20ms | 2026-09-19T21:18:33 | |
| tc_9b270810 | run_mactime | 7175ms | 2026-09-19T21:18:41 | |
| tc_7b8cf646 | run_fls | 8142ms | 2026-09-19T21:18:42 | |
| tc_cad5cee6 | detect_masquerading | 8956ms | 2026-09-19T21:18:42 | |
| tc_c44c6c16 | run_bulk_extractor | 109923ms | 2026-09-19T21:20:18 | |
| tc_a2853824 | run_bulk_extractor | 105101ms | 2026-09-19T21:20:19 | |
| tc_2eff2321 | get_completed_results | 0ms | 2026-09-19T21:20:20 | |
| tc_0d287f2b | start_extraction_batch | 29ms | 2026-09-19T21:20:25 | |
| tc_ef5d4c82 | run_mft_parser | 64ms | 2026-09-19T21:20:25 | |
| tc_6f59ba72 | run_registry_parser | 5873ms | 2026-09-19T21:20:31 | |
| tc_3987f382 | run_prefetch_parser | 8189ms | 2026-09-19T21:20:33 | |
| tc_1009d65a | yara_scan_files | 16164ms | 2026-09-19T21:20:41 | |
| tc_b8d883e4 | run_strings | 1253ms | 2026-09-19T21:22:21 | |
| tc_50b24206 | run_amcache_parser | 2771ms | 2026-09-19T21:22:23 | |
| tc_cb401e1d | run_fls | 1523ms | 2026-09-19T21:22:25 | |
| tc_f317c7dd | run_evtx_parser | 0ms | 2026-09-19T21:22:27 | |
| tc_35d45239 | run_shimcache_parser | 7754ms | 2026-09-19T21:22:28 | |
| tc_6b56db2e | get_completed_results | 0ms | 2026-09-19T21:22:28 | |
| tc_b340429a | parse_browser_history | 12230ms | 2026-09-19T21:22:32 | |
| tc_d3437e6a | start_extraction_batch | 15ms | 2026-09-19T21:22:32 | |
| tc_52890b64 | run_amcache_parser | 3337ms | 2026-09-19T21:22:36 | |
| tc_d403aa45 | run_mft_parser | 48ms | 2026-09-19T21:22:36 | |
| tc_6e01e3bf | get_completed_results | 0ms | 2026-09-19T21:22:36 | |
| tc_7bd9a458 | query_registry_value | 0ms | 2026-09-19T21:22:38 | |
| tc_7ab8850d | run_evtx_parser | 0ms | 2026-09-19T21:22:40 | |
| tc_d8ce940f | run_shimcache_parser | 8191ms | 2026-09-19T21:22:41 | |
| tc_80f2b64b | query_registry_value | 0ms | 2026-09-19T21:22:46 | |
| tc_c036de2b | query_registry_value | 0ms | 2026-09-19T21:22:49 | |
| tc_d63dc045 | query_registry_value | 0ms | 2026-09-19T21:22:50 | |
| tc_7046c92a | query_registry_value | 0ms | 2026-09-19T21:22:51 | |
| tc_3c659280 | run_registry_parser | 13456ms | 2026-09-19T21:22:51 | |
| tc_88fda9ef | query_registry_value | 0ms | 2026-09-19T21:22:52 | |
| tc_c45e5680 | start_extraction_batch | 3ms | 2026-09-19T21:22:52 | |
| tc_d0d6d24d | run_prefetch_parser | 16202ms | 2026-09-19T21:22:54 | |
| tc_dd489876 | parse_browser_history | 18015ms | 2026-09-19T21:22:54 | |
| tc_337a4af2 | analyze_disk_pcaps | 1676ms | 2026-09-19T21:22:59 | |
| tc_4ff91ddb | index_app_files | 2903ms | 2026-09-19T21:23:00 | |
| tc_d2a5d8f5 | get_completed_results | 0ms | 2026-09-19T21:23:01 | |
| tc_2ec9b59f | index_app_files | 6749ms | 2026-09-19T21:23:04 | |
| tc_cd945be6 | get_completed_results | 0ms | 2026-09-19T21:23:06 | |
| tc_5fc875d5 | run_hindsight | 0ms | 2026-09-19T21:23:07 | |
| tc_64e6d4ba | run_exiftool | 96ms | 2026-09-19T21:23:07 | |
| tc_675ffbab | run_bulk_extractor | 298288ms | 2026-09-19T21:23:09 | |
| tc_678afe89 | run_hayabusa | 2356ms | 2026-09-19T21:23:09 | |
| tc_80ec036a | detect_masquerading | 300019ms | 2026-09-19T21:23:10 | |
| tc_df5c0176 | get_completed_results | 0ms | 2026-09-19T21:23:12 | |
| tc_92a0a892 | run_registry_parser | 2904ms | 2026-09-19T21:23:15 | |
| tc_53519637 | yara_scan_files | 8214ms | 2026-09-19T21:23:15 | |
| tc_513429dd | open_case | 30ms | 2026-09-19T21:23:18 | |
| tc_03388a2b | wait_all | 0ms | 2026-09-19T21:23:19 | |
| tc_96e1f6e2 | open_case | 29ms | 2026-09-19T21:23:24 | |
| tc_338e2535 | start_extraction_batch | 16ms | 2026-09-19T21:23:25 | |
| tc_fcd0d491 | get_investigation_summary | 5ms | 2026-09-19T21:23:28 | |
| tc_358355f6 | list_sources | 1ms | 2026-09-19T21:23:28 | |
| tc_527678dc | open_case | 35ms | 2026-09-19T21:23:28 | |
| tc_ed9abe71 | wait_all | 0ms | 2026-09-19T21:23:29 | |
| tc_3816fb2e | start_extraction_batch | 1ms | 2026-09-19T21:23:30 | |
| tc_bcf42b07 | run_amcache_parser | 0ms | 2026-09-19T21:23:31 | |
| tc_22e51a7d | run_hindsight | 0ms | 2026-09-19T21:23:31 | |
| tc_e4a6045c | get_raw_output | 7ms | 2026-09-19T21:23:32 | |
| tc_bede60c2 | get_raw_output | 45ms | 2026-09-19T21:23:33 | |
| tc_b69591e7 | get_raw_output | 44ms | 2026-09-19T21:23:33 | |
| tc_85c33e14 | open_case | 30ms | 2026-09-19T21:23:36 | |
| tc_709f5936 | list_sources | 2ms | 2026-09-19T21:23:37 | |
| tc_f361450d | get_investigation_summary | 3ms | 2026-09-19T21:23:37 | |
| tc_6d851849 | get_raw_output | 52ms | 2026-09-19T21:23:41 | |
| tc_06ba03a9 | get_raw_output | 49ms | 2026-09-19T21:23:41 | |
| tc_98bfb047 | run_mft_parser | 17606ms | 2026-09-19T21:23:43 | |
| tc_5d7dd9df | run_evtx_parser | 17624ms | 2026-09-19T21:23:43 | |
| tc_26b8be6e | query_registry_value | 17656ms | 2026-09-19T21:23:43 | |
| tc_1270b0c3 | query_registry_value | 17667ms | 2026-09-19T21:23:43 | |
| tc_4adbc976 | run_shimcache_parser | 17669ms | 2026-09-19T21:23:43 | |
| tc_88137af9 | run_exiftool | 61ms | 2026-09-19T21:23:43 | |
| tc_3f49b9b8 | parse_browser_history | 12364ms | 2026-09-19T21:23:43 | |
| tc_9d4605b4 | get_raw_output | 52ms | 2026-09-19T21:23:44 | |
| tc_a6690fe1 | get_raw_output | 15ms | 2026-09-19T21:23:44 | |
| tc_182fac0d | get_raw_output | 15ms | 2026-09-19T21:23:45 | |
| tc_3b535f66 | run_prefetch_parser | 21572ms | 2026-09-19T21:23:47 | |
| tc_0ac061d2 | search | 7ms | 2026-09-19T21:23:47 | |
| tc_1a4b258a | search | 5ms | 2026-09-19T21:23:47 | |
| tc_1c47e12d | search | 3ms | 2026-09-19T21:23:47 | |
| tc_d9ff05aa | get_raw_output | 6ms | 2026-09-19T21:23:49 | |
| tc_796d334a | get_raw_output | 50ms | 2026-09-19T21:23:50 | |
| tc_37df0e2b | search | 8ms | 2026-09-19T21:23:52 | |
| tc_2659ba87 | search | 2ms | 2026-09-19T21:23:52 | |
| tc_d8adb5f2 | search | 4ms | 2026-09-19T21:23:52 | |
| tc_c6a1e6d1 | get_raw_output | 51ms | 2026-09-19T21:23:52 | |
| tc_3e3a6796 | get_raw_output | 50ms | 2026-09-19T21:23:52 | |
| tc_7f4c420f | search | 6ms | 2026-09-19T21:23:57 | |
| tc_d617599c | get_raw_output | 13ms | 2026-09-19T21:23:57 | |
| tc_f15f6752 | search | 4ms | 2026-09-19T21:23:57 | |
| tc_33000144 | search | 7ms | 2026-09-19T21:23:57 | |
| tc_c3c3bbc0 | search | 5ms | 2026-09-19T21:23:57 | |
| tc_b2f974dd | search | 4ms | 2026-09-19T21:24:04 | |
| tc_10ae7faf | search | 3ms | 2026-09-19T21:24:04 | |
| tc_6d1f72b6 | search | 3ms | 2026-09-19T21:24:04 | |
| tc_66079d4b | yara_scan_files | 21057ms | 2026-09-19T21:24:04 | |
| tc_2cf5ac06 | run_registry_parser | 40548ms | 2026-09-19T21:24:06 | |
| tc_29a7500c | wait_all | 35041ms | 2026-09-19T21:24:06 | |
| tc_419fed94 | get_completed_results | 0ms | 2026-09-19T21:24:09 | |
| tc_81f366b5 | get_completed_results | 0ms | 2026-09-19T21:24:09 | |
| tc_948f80a6 | start_extraction_batch | 3ms | 2026-09-19T21:24:09 | |
| tc_686f7bda | search | 4ms | 2026-09-19T21:24:09 | |
| tc_9d43eadd | search | 7ms | 2026-09-19T21:24:09 | |
| tc_ae7e8c70 | search | 6ms | 2026-09-19T21:24:10 | |
| tc_6f786bc7 | search | 6ms | 2026-09-19T21:24:10 | |
| tc_601760e8 | search | 3ms | 2026-09-19T21:24:10 | |
| tc_a68ca545 | get_raw_output | 51ms | 2026-09-19T21:24:18 | |
| tc_c849d0c7 | search | 4ms | 2026-09-19T21:24:18 | |
| tc_16010eb5 | search | 3ms | 2026-09-19T21:24:18 | |
| tc_2595cbd0 | run_hayabusa | 11596ms | 2026-09-19T21:24:21 | |
| tc_3af2aeec | get_completed_results | 0ms | 2026-09-19T21:24:22 | |
| tc_38c73f59 | get_raw_output | 51ms | 2026-09-19T21:24:23 | |
| tc_d27c92a0 | get_raw_output | 50ms | 2026-09-19T21:24:23 | |
| tc_582eac39 | get_raw_output | 51ms | 2026-09-19T21:24:28 | |
| tc_5738fb74 | get_raw_output | 51ms | 2026-09-19T21:24:28 | |
| tc_c4528816 | open_case | 30ms | 2026-09-19T21:24:30 | |
| tc_0f88ecb3 | wait_all | 0ms | 2026-09-19T21:24:30 | |
| tc_ce033776 | search | 6ms | 2026-09-19T21:24:32 | |
| tc_3488b2a7 | search | 5ms | 2026-09-19T21:24:32 | |
| tc_3d3946f2 | get_raw_output | 9ms | 2026-09-19T21:24:32 | |
| tc_2ec72186 | search | 3ms | 2026-09-19T21:24:32 | |
| tc_609b2b5f | search | 2ms | 2026-09-19T21:24:33 | |
| tc_1dbca0dd | open_case | 29ms | 2026-09-19T21:24:35 | |
| tc_6b3ad093 | get_investigation_summary | 5ms | 2026-09-19T21:24:36 | |
| tc_d6161023 | list_sources | 1ms | 2026-09-19T21:24:36 | |
| tc_4a1c5881 | search | 5ms | 2026-09-19T21:24:37 | |
| tc_c0a15c51 | search | 5ms | 2026-09-19T21:24:37 | |
| tc_98465db3 | get_raw_output | 52ms | 2026-09-19T21:24:38 | |
| tc_5557cc3a | get_raw_output | 51ms | 2026-09-19T21:24:38 | |
| tc_627d5719 | get_raw_output | 50ms | 2026-09-19T21:24:38 | |
| tc_8dfea8b2 | get_raw_output | 50ms | 2026-09-19T21:24:38 | |
| tc_c27897f1 | search | 4ms | 2026-09-19T21:24:42 | |
| tc_d6e37f5c | get_raw_output | 14ms | 2026-09-19T21:24:42 | |
| tc_702af13a | search | 3ms | 2026-09-19T21:24:44 | |
| tc_aa5b91c2 | search | 3ms | 2026-09-19T21:24:44 | |
| tc_784a7d87 | search | 2ms | 2026-09-19T21:24:44 | |
| tc_8848bb7e | get_raw_output | 52ms | 2026-09-19T21:24:48 | |
| tc_28755812 | get_raw_output | 51ms | 2026-09-19T21:24:48 | |
| tc_051599ba | search | 4ms | 2026-09-19T21:24:48 | |
| tc_55c9dea8 | get_raw_output | 51ms | 2026-09-19T21:24:48 | |
| tc_51fe23b6 | get_raw_output | 50ms | 2026-09-19T21:24:57 | |
| tc_f9ba3b97 | search | 40ms | 2026-09-19T21:24:57 | |
| tc_88129824 | search | 4ms | 2026-09-19T21:25:00 | |
| tc_dd6666c9 | search | 4ms | 2026-09-19T21:25:00 | |
| tc_ea4e2296 | search | 6ms | 2026-09-19T21:25:00 | |
| tc_cec2dcde | search | 2ms | 2026-09-19T21:25:00 | |
| tc_89505b6f | get_deleted_files | 133ms | 2026-09-19T21:25:01 | |
| tc_38247814 | get_raw_output | 50ms | 2026-09-19T21:25:01 | |
| tc_e9ce7c53 | get_raw_output | 51ms | 2026-09-19T21:25:07 | |
| tc_0d461a9f | get_deleted_files | 133ms | 2026-09-19T21:25:07 | |
| tc_2de71e18 | search | 6ms | 2026-09-19T21:25:10 | |
| tc_fd2941de | get_raw_output | 50ms | 2026-09-19T21:25:10 | |
| tc_7ed2e324 | get_raw_output | 50ms | 2026-09-19T21:25:10 | |
| tc_fd05dd86 | get_raw_output | 50ms | 2026-09-19T21:25:10 | |
| tc_61213edd | search | 4ms | 2026-09-19T21:25:11 | |
| tc_3abdb558 | search | 2ms | 2026-09-19T21:25:11 | |
| tc_0ff1c888 | search | 3ms | 2026-09-19T21:25:11 | |
| tc_259023be | search | 3ms | 2026-09-19T21:25:13 | |
| tc_8b575da7 | get_raw_output | 6ms | 2026-09-19T21:25:22 | |
| tc_e867b2bb | get_raw_output | 51ms | 2026-09-19T21:25:27 | |
| tc_c365e2bd | search | 3ms | 2026-09-19T21:25:27 | |
| tc_4178f11d | get_raw_output | 6ms | 2026-09-19T21:25:31 | |
| tc_850b6aa8 | search | 3ms | 2026-09-19T21:25:36 | |
| tc_318449c7 | search | 5ms | 2026-09-19T21:25:36 | |
| tc_cb9146d8 | search | 3ms | 2026-09-19T21:25:36 | |
| tc_ca66bdd0 | search | 4ms | 2026-09-19T21:25:38 | |
| tc_7af54d78 | search | 3ms | 2026-09-19T21:25:38 | |
| tc_29dbdf0a | get_deleted_files | 181ms | 2026-09-19T21:25:40 | |
| tc_f1791259 | search | 3ms | 2026-09-19T21:25:40 | |
| tc_98f8bd4c | get_raw_output | 51ms | 2026-09-19T21:25:44 | |
| tc_e59fe1f9 | get_raw_output | 6ms | 2026-09-19T21:25:44 | |
| tc_12df1754 | get_raw_output | 50ms | 2026-09-19T21:25:46 | |
| tc_7b788580 | search | 3ms | 2026-09-19T21:25:46 | |
| tc_47a59a81 | search | 3ms | 2026-09-19T21:25:53 | |
| tc_5c2f17e9 | search | 3ms | 2026-09-19T21:25:53 | |
| tc_c26831ef | search | 3ms | 2026-09-19T21:25:53 | |
| tc_66b4aab5 | search | 3ms | 2026-09-19T21:25:53 | |
| tc_3bf236c6 | search | 2ms | 2026-09-19T21:25:53 | |
| tc_21d50508 | search | 4ms | 2026-09-19T21:25:58 | |
| tc_d2c9e12f | search | 3ms | 2026-09-19T21:25:58 | |
| tc_b2e997c3 | search | 3ms | 2026-09-19T21:25:59 | |
| tc_f7fb1c15 | get_raw_output | 6ms | 2026-09-19T21:26:04 | |
| tc_d6ba85ad | search | 4ms | 2026-09-19T21:26:05 | |
| tc_009ec5d0 | search | 2ms | 2026-09-19T21:26:05 | |
| tc_4af90084 | search | 3ms | 2026-09-19T21:26:06 | |
| tc_4c3472d0 | search | 3ms | 2026-09-19T21:26:11 | |
| tc_33475799 | search | 3ms | 2026-09-19T21:26:12 | |
| tc_09bd5cce | search | 3ms | 2026-09-19T21:26:13 | |
| tc_a76d2a4b | search | 3ms | 2026-09-19T21:26:16 | |
| tc_89c58183 | search | 4ms | 2026-09-19T21:26:16 | |
| tc_99c66247 | search | 44ms | 2026-09-19T21:26:28 | |
| tc_bd4a4b52 | search | 3ms | 2026-09-19T21:26:28 | |
| tc_418acf52 | search | 3ms | 2026-09-19T21:26:28 | |
| tc_6b041d1c | search | 24ms | 2026-09-19T21:26:29 | |
| tc_4c6e1e4c | search | 3ms | 2026-09-19T21:26:29 | |
| tc_a246e552 | search | 3ms | 2026-09-19T21:26:41 | |
| tc_d477f551 | search | 3ms | 2026-09-19T21:26:48 | |
| tc_f0d69c30 | submit_finding | 13ms | 2026-09-19T21:26:52 | |
| tc_e4e6ecef | search | 3ms | 2026-09-19T21:26:52 | |
| tc_69aee1b0 | search | 2ms | 2026-09-19T21:26:52 | |
| tc_81d93634 | search | 3ms | 2026-09-19T21:26:55 | |
| tc_16bf3fa2 | search | 3ms | 2026-09-19T21:27:08 | |
| tc_a165ca11 | search | 2ms | 2026-09-19T21:27:08 | |
| tc_4e1660b4 | submit_finding | 9ms | 2026-09-19T21:27:18 | |
| tc_4460bcde | search | 3ms | 2026-09-19T21:27:20 | |
| tc_132779e5 | submit_finding | 11ms | 2026-09-19T21:27:30 | |
| tc_49c9eef5 | search | 3ms | 2026-09-19T21:27:32 | |
| tc_b470d987 | search | 3ms | 2026-09-19T21:27:39 | |
| tc_a2ba5c3d | search | 3ms | 2026-09-19T21:27:40 | |
| tc_df9570f0 | search | 2ms | 2026-09-19T21:27:40 | |
| tc_0590ffe5 | submit_finding | 10ms | 2026-09-19T21:27:43 | |
| tc_ea325118 | search | 3ms | 2026-09-19T21:27:49 | |
| tc_9ede8b5c | search | 3ms | 2026-09-19T21:27:58 | |
| tc_dacfa817 | search | 3ms | 2026-09-19T21:27:58 | |
| tc_171e3ad5 | search | 3ms | 2026-09-19T21:27:59 | |
| tc_010b35bf | submit_finding | 11ms | 2026-09-19T21:28:05 | |
| tc_ea8b55ac | search | 3ms | 2026-09-19T21:28:09 | |
| tc_c31fe0c2 | search | 3ms | 2026-09-19T21:28:19 | |
| tc_9c7904b5 | submit_finding | 12ms | 2026-09-19T21:28:22 | |
| tc_a9ae3d39 | search | 3ms | 2026-09-19T21:28:23 | |
| tc_04e3eb9f | search | 2ms | 2026-09-19T21:28:23 | |
| tc_b391e072 | search | 3ms | 2026-09-19T21:28:32 | |
| tc_1e86b298 | submit_finding | 11ms | 2026-09-19T21:28:41 | |
| tc_394617af | search | 3ms | 2026-09-19T21:28:42 | |
| tc_206ab3e6 | search | 2ms | 2026-09-19T21:28:42 | |
| tc_9bd7fb25 | search | 3ms | 2026-09-19T21:28:47 | |
| tc_91d5c507 | search | 3ms | 2026-09-19T21:28:56 | |
| tc_e1cc50b5 | search | 2ms | 2026-09-19T21:28:56 | |
| tc_5f391f16 | search | 4ms | 2026-09-19T21:28:58 | |
| tc_0108cfa3 | submit_finding | 12ms | 2026-09-19T21:29:06 | |
| tc_1301e534 | search | 3ms | 2026-09-19T21:29:09 | |
| tc_36ce299d | search | 2ms | 2026-09-19T21:29:09 | |
| tc_6bc119b7 | search | 3ms | 2026-09-19T21:29:14 | |
| tc_ef6b1b54 | get_timeline | 60ms | 2026-09-19T21:29:22 | |
| tc_f98cf61a | search | 3ms | 2026-09-19T21:29:23 | |
| tc_5c6215d0 | search | 2ms | 2026-09-19T21:29:23 | |
| tc_85b528cf | search | 3ms | 2026-09-19T21:29:25 | |
| tc_51ffc70a | search | 3ms | 2026-09-19T21:29:31 | |
| tc_d210694c | search | 4ms | 2026-09-19T21:29:33 | |
| tc_6933f25d | search | 2ms | 2026-09-19T21:29:33 | |
| tc_72b3cac8 | search | 3ms | 2026-09-19T21:29:39 | |
| tc_a6fc78fc | search | 2ms | 2026-09-19T21:29:39 | |
| tc_756721c9 | search | 3ms | 2026-09-19T21:29:45 | |
| tc_240a7bab | submit_finding | 10ms | 2026-09-19T21:29:48 | |
| tc_0263f12c | search | 3ms | 2026-09-19T21:29:54 | |
| tc_87de1e0a | update_finding | 10ms | 2026-09-19T21:29:59 | |
| tc_988fc597 | search | 3ms | 2026-09-19T21:30:01 | |
| tc_1950c8ee | search | 3ms | 2026-09-19T21:30:07 | |
| tc_975382ee | search | 3ms | 2026-09-19T21:30:07 | |
| tc_26ce8804 | search | 3ms | 2026-09-19T21:30:14 | |
| tc_62cd0386 | search | 3ms | 2026-09-19T21:30:21 | |
| tc_3183594d | search | 3ms | 2026-09-19T21:30:21 | |
| tc_55e71609 | search | 2ms | 2026-09-19T21:30:21 | |
| tc_eda500f9 | submit_finding | 11ms | 2026-09-19T21:30:22 | |
| tc_3b733c8d | search | 3ms | 2026-09-19T21:30:30 | |
| tc_c11748a6 | search | 3ms | 2026-09-19T21:30:35 | |
| tc_8a90f48a | search | 2ms | 2026-09-19T21:30:35 | |
| tc_06481ab9 | submit_finding | 11ms | 2026-09-19T21:30:36 | |
| tc_86c5c8f8 | search | 3ms | 2026-09-19T21:30:45 | |
| tc_ac5f5b81 | search | 3ms | 2026-09-19T21:30:49 | |
| tc_8366a4ab | search | 3ms | 2026-09-19T21:30:49 | |
| tc_017120c3 | track_progress | 8ms | 2026-09-19T21:30:50 | |
| tc_545ef2d6 | search | 3ms | 2026-09-19T21:30:54 | |
| tc_8ef953c9 | search | 3ms | 2026-09-19T21:31:04 | |
| tc_97a38539 | get_findings | 1ms | 2026-09-19T21:31:05 | |
| tc_d6481629 | search | 3ms | 2026-09-19T21:31:09 | |
| tc_247346e0 | search | 2ms | 2026-09-19T21:31:09 | |
| tc_365d6ac3 | search | 3ms | 2026-09-19T21:31:19 | |
| tc_c3f25cc7 | get_investigation_summary | 5ms | 2026-09-19T21:31:21 | |
| tc_baf2bebe | search | 3ms | 2026-09-19T21:31:23 | |
| tc_04db5422 | search | 2ms | 2026-09-19T21:31:23 | |
| tc_1dac1441 | open_case | 31ms | 2026-09-19T21:31:26 | |
| tc_e3ca34c1 | search | 3ms | 2026-09-19T21:31:35 | |
| tc_49224efd | open_case | 30ms | 2026-09-19T21:31:36 | |
| tc_892feff6 | search | 3ms | 2026-09-19T21:31:42 | |
| tc_1b29ac56 | start_extraction_batch | 8ms | 2026-09-19T21:31:47 | |
| tc_847e0992 | detect_masquerading | 0ms | 2026-09-19T21:31:47 | |
| tc_cf49fa59 | run_optical_listing | 81ms | 2026-09-19T21:31:47 | |
| tc_f026babe | search | 3ms | 2026-09-19T21:31:53 | |
| tc_37cd7032 | search | 3ms | 2026-09-19T21:31:53 | |
| tc_16b0e33e | yara_scan_files | 5955ms | 2026-09-19T21:31:53 | |
| tc_7f9458de | run_bulk_extractor | 6134ms | 2026-09-19T21:31:53 | |
| tc_e901e652 | search | 3ms | 2026-09-19T21:31:54 | |
| tc_3a398e0d | get_completed_results | 0ms | 2026-09-19T21:31:55 | |
| tc_5a774519 | run_optical_listing | 0ms | 2026-09-19T21:31:57 | |
| tc_a9e0771d | read_evidence_file | 1ms | 2026-09-19T21:32:00 | |
| tc_d1c7ae68 | search | 3ms | 2026-09-19T21:32:04 | |
| tc_d70a3ff6 | run_optical_listing | 0ms | 2026-09-19T21:32:05 | |
| tc_648b9304 | run_optical_listing | 0ms | 2026-09-19T21:32:06 | |
| tc_43a86bbd | list_cases | 5ms | 2026-09-19T21:32:08 | |
| tc_15ce5848 | read_evidence_file | 2ms | 2026-09-19T21:32:09 | |
| tc_6bcf07d1 | read_evidence_file | 1ms | 2026-09-19T21:32:09 | |
| tc_a02d0680 | extract_optical_file | 0ms | 2026-09-19T21:32:11 | |
| tc_e06cfac8 | search | 3ms | 2026-09-19T21:32:11 | |
| tc_989e2239 | search | 3ms | 2026-09-19T21:32:19 | |
| tc_93075ae1 | extract_optical_file | 67ms | 2026-09-19T21:32:20 | |
| tc_bcb9bd83 | extract_optical_file | 85ms | 2026-09-19T21:32:20 | |
| tc_1addecad | extract_optical_file | 107ms | 2026-09-19T21:32:20 | |
| tc_d9e1bd8a | extract_optical_file | 110ms | 2026-09-19T21:32:20 | |
| tc_a3e9db63 | extract_optical_file | 110ms | 2026-09-19T21:32:20 | |
| tc_c80d729a | extract_optical_file | 123ms | 2026-09-19T21:32:20 | |
| tc_519c161d | extract_optical_file | 57ms | 2026-09-19T21:32:20 | |
| tc_40c36de5 | extract_optical_file | 132ms | 2026-09-19T21:32:20 | |
| tc_8e5aba5e | extract_optical_file | 154ms | 2026-09-19T21:32:20 | |
| tc_0caab271 | extract_optical_file | 71ms | 2026-09-19T21:32:20 | |
| tc_2bec107d | extract_optical_file | 71ms | 2026-09-19T21:32:20 | |
| tc_b719280e | extract_optical_file | 84ms | 2026-09-19T21:32:20 | |
| tc_7e56e948 | extract_optical_file | 66ms | 2026-09-19T21:32:20 | |
| tc_33976e72 | extract_optical_file | 84ms | 2026-09-19T21:32:20 | |
| tc_f9a91be3 | extract_optical_file | 59ms | 2026-09-19T21:32:20 | |
| tc_58c57d9b | extract_optical_file | 57ms | 2026-09-19T21:32:20 | |
| tc_af4a1df7 | extract_optical_file | 63ms | 2026-09-19T21:32:20 | |
| tc_78d6ec3e | extract_optical_file | 60ms | 2026-09-19T21:32:20 | |
| tc_063b54e5 | extract_optical_file | 154ms | 2026-09-19T21:32:20 | |
| tc_2f411485 | extract_optical_file | 62ms | 2026-09-19T21:32:20 | |
| tc_b504e7bf | extract_optical_file | 62ms | 2026-09-19T21:32:20 | |
| tc_1f47f3ff | extract_optical_file | 63ms | 2026-09-19T21:32:20 | |
| tc_46d8dd1a | extract_optical_file | 59ms | 2026-09-19T21:32:20 | |
| tc_39dea5aa | extract_optical_file | 162ms | 2026-09-19T21:32:20 | |
| tc_e7d04bf1 | extract_optical_file | 55ms | 2026-09-19T21:32:20 | |
| tc_6343e937 | extract_optical_file | 56ms | 2026-09-19T21:32:20 | |
| tc_4ce1de7b | extract_optical_file | 51ms | 2026-09-19T21:32:20 | |
| tc_19e3b23f | read_evidence_file | 15ms | 2026-09-19T21:32:25 | |
| tc_699065de | read_evidence_file | 49ms | 2026-09-19T21:32:25 | |
| tc_0b43ac39 | read_evidence_file | 20ms | 2026-09-19T21:32:25 | |
| tc_f520daa0 | read_evidence_file | 37ms | 2026-09-19T21:32:25 | |
| tc_b038ca5a | read_evidence_file | 13ms | 2026-09-19T21:32:25 | |
| tc_3a378c4f | read_evidence_file | 4ms | 2026-09-19T21:32:25 | |
| tc_431833ad | detect_steganography | 222ms | 2026-09-19T21:32:25 | |
| tc_ab7a9ea2 | run_hashdeep | 243ms | 2026-09-19T21:32:25 | |
| tc_bc0a1de6 | run_exiftool | 412ms | 2026-09-19T21:32:25 | |
| tc_e721151b | yara_scan_files | 743ms | 2026-09-19T21:32:26 | |
| tc_b31d69b2 | search | 3ms | 2026-09-19T21:32:26 | |
| tc_6e23a7ee | search | 2ms | 2026-09-19T21:32:26 | |
| tc_2fec143e | search | 3ms | 2026-09-19T21:32:29 | |
| tc_4e31e6fb | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_f912b7e6 | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_d8fc88bb | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_ec95a593 | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_e6039d3f | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_fcd5c0ac | analyze_office_document | 0ms | 2026-09-19T21:32:32 | |
| tc_37f40642 | search | 3ms | 2026-09-19T21:32:36 | |
| tc_9cef2dd8 | search | 3ms | 2026-09-19T21:32:43 | |
| tc_1b9e37fb | search | 3ms | 2026-09-19T21:32:44 | |
| tc_fc5b74d6 | search | 2ms | 2026-09-19T21:32:44 | |
| tc_68a6ec55 | search | 3ms | 2026-09-19T21:32:51 | |
| tc_693a5c95 | open_case | 31ms | 2026-09-19T21:32:52 | |
| tc_42aab88a | list_sources | 3ms | 2026-09-19T21:32:53 | |
| tc_73472d83 | get_investigation_summary | 4ms | 2026-09-19T21:32:53 | |
| tc_74edfdbd | get_raw_output | 51ms | 2026-09-19T21:32:56 | |
| tc_64408059 | get_raw_output | 49ms | 2026-09-19T21:32:56 | |
| tc_63253b02 | search | 3ms | 2026-09-19T21:32:58 | |
| tc_e0c26c57 | get_raw_output | 51ms | 2026-09-19T21:32:59 | |
| tc_53cd40a2 | get_raw_output | 50ms | 2026-09-19T21:32:59 | |
| tc_d804b917 | get_raw_output | 50ms | 2026-09-19T21:32:59 | |
| tc_3317be64 | get_raw_output | 15ms | 2026-09-19T21:33:02 | |
| tc_36eb8baf | get_raw_output | 14ms | 2026-09-19T21:33:02 | |
| tc_e03e29b1 | get_raw_output | 9ms | 2026-09-19T21:33:03 | |
| tc_74f2d819 | search | 3ms | 2026-09-19T21:33:03 | |
| tc_0a29ddf6 | search | 3ms | 2026-09-19T21:33:03 | |
| tc_7b270c66 | open_case | 30ms | 2026-09-19T21:33:06 | |
| tc_379d83be | get_investigation_summary | 5ms | 2026-09-19T21:33:06 | |
| tc_d380e68b | get_findings | 1ms | 2026-09-19T21:33:06 | |
| tc_7f98018e | get_source_stats | 51ms | 2026-09-19T21:33:08 | |
| tc_feebb7b3 | list_sources | 1ms | 2026-09-19T21:33:08 | |
| tc_5bfffcd4 | get_raw_output | 52ms | 2026-09-19T21:33:11 | |
| tc_27951806 | get_raw_output | 49ms | 2026-09-19T21:33:11 | |
| tc_8fe45d09 | get_raw_output | 49ms | 2026-09-19T21:33:11 | |
| tc_0928a0d9 | search | 4ms | 2026-09-19T21:33:13 | |
| tc_c5a3937e | search | 2ms | 2026-09-19T21:33:13 | |
| tc_abb35244 | get_raw_output | 50ms | 2026-09-19T21:33:22 | |
| tc_725629fb | search | 3ms | 2026-09-19T21:33:22 | |
| tc_5a09683b | get_raw_output | 52ms | 2026-09-19T21:33:23 | |
| tc_02ac902a | get_raw_output | 50ms | 2026-09-19T21:33:23 | |
| tc_fcaa1422 | read_evidence_file | 2ms | 2026-09-19T21:33:30 | |
| tc_09046383 | read_evidence_file | 1ms | 2026-09-19T21:33:30 | |
| tc_81d9c4cc | search | 3ms | 2026-09-19T21:33:30 | |
| tc_0418c037 | search | 2ms | 2026-09-19T21:33:30 | |
| tc_cf46172a | search | 5ms | 2026-09-19T21:33:34 | |
| tc_e926ac41 | search | 3ms | 2026-09-19T21:33:34 | |
| tc_926ea060 | search | 4ms | 2026-09-19T21:33:39 | |
| tc_3ca55086 | get_findings | 1ms | 2026-09-19T21:33:39 | |
| tc_6014173f | get_raw_output | 51ms | 2026-09-19T21:33:42 | |
| tc_c2ba5c18 | search | 10ms | 2026-09-19T21:33:42 | |
| tc_57a83d43 | get_raw_output | 60ms | 2026-09-19T21:33:45 | |
| tc_5cc20f73 | search | 3ms | 2026-09-19T21:33:45 | |
| tc_4c7b8b0f | search | 3ms | 2026-09-19T21:33:50 | |
| tc_1e3055de | search | 2ms | 2026-09-19T21:33:50 | |
| tc_496b958b | search | 3ms | 2026-09-19T21:33:52 | |
| tc_7a774433 | search | 3ms | 2026-09-19T21:33:52 | |
| tc_47ef50af | search | 3ms | 2026-09-19T21:33:52 | |
| tc_2aa5dd96 | search | 3ms | 2026-09-19T21:33:52 | |
| tc_0e4a5a21 | get_raw_output | 50ms | 2026-09-19T21:33:59 | |
| tc_80f46252 | get_raw_output | 50ms | 2026-09-19T21:34:07 | |
| tc_335f12e8 | search | 3ms | 2026-09-19T21:34:12 | |
| tc_c3b301b9 | submit_finding | 12ms | 2026-09-19T21:34:12 | |
| tc_dac8a42e | submit_finding | 11ms | 2026-09-19T21:34:12 | |
| tc_6ff26969 | submit_finding | 11ms | 2026-09-19T21:34:12 | |
| tc_59445f36 | search | 4ms | 2026-09-19T21:34:21 | |
| tc_9cb4afc7 | submit_finding | 12ms | 2026-09-19T21:34:24 | |
| tc_2ca09331 | submit_finding | 11ms | 2026-09-19T21:34:24 | |
| tc_a2c558d9 | search | 3ms | 2026-09-19T21:34:28 | |
| tc_5f6bbbf2 | update_finding | 13ms | 2026-09-19T21:34:32 | |
| tc_0509a200 | submit_finding | 11ms | 2026-09-19T21:34:32 | |
| tc_05cf6deb | track_progress | 12ms | 2026-09-19T21:34:41 | |
| tc_8b055c5b | get_investigation_summary | 3ms | 2026-09-19T21:34:41 | |
| tc_60481d4e | query_registry_value | 4511ms | 2026-09-19T21:34:42 | |
| tc_02bd10ac | get_investigation_summary | 4ms | 2026-09-19T21:35:05 | |
| tc_84d0224a | query_registry_value | 4446ms | 2026-09-19T21:35:07 | |
| tc_a9fa6b01 | query_registry_value | 4535ms | 2026-09-19T21:35:22 | |
| tc_45f07e20 | query_registry_value | 4515ms | 2026-09-19T21:35:26 | |
| tc_45c979e1 | query_registry_value | 4528ms | 2026-09-19T21:35:37 | |
| tc_18847905 | query_registry_value | 4489ms | 2026-09-19T21:35:41 | |
| tc_a851b5a5 | get_raw_output | 9ms | 2026-09-19T21:35:47 | |
| tc_fe9ae367 | search | 5ms | 2026-09-19T21:35:49 | |
| tc_f4072419 | search | 4ms | 2026-09-19T21:35:49 | |
| tc_0208bb4d | search | 8ms | 2026-09-19T21:35:49 | |
| tc_c1248c69 | query_registry_value | 4520ms | 2026-09-19T21:35:50 | |
| tc_f905a258 | search | 3ms | 2026-09-19T21:35:52 | |
| tc_b38a364d | search | 3ms | 2026-09-19T21:35:52 | |
| tc_88b90133 | get_raw_output | 6ms | 2026-09-19T21:35:54 | |
| tc_1ea52806 | search | 4ms | 2026-09-19T21:35:56 | |
| tc_c8b21ca2 | search | 3ms | 2026-09-19T21:35:56 | |
| tc_b9500839 | search | 4ms | 2026-09-19T21:35:56 | |
| tc_31ddeed7 | search | 3ms | 2026-09-19T21:36:01 | |
| tc_4bc2738a | search | 3ms | 2026-09-19T21:36:03 | |
| tc_0a46f297 | search | 3ms | 2026-09-19T21:36:03 | |
| tc_b0ae0a6e | get_raw_output | 50ms | 2026-09-19T21:36:06 | |
| tc_1757e4aa | search | 5ms | 2026-09-19T21:36:07 | |
| tc_802aba5e | search | 3ms | 2026-09-19T21:36:14 | |
| tc_452f2253 | search | 3ms | 2026-09-19T21:36:14 | |
| tc_77fc350b | get_raw_output | 9ms | 2026-09-19T21:36:14 | |
| tc_98647f1a | search | 3ms | 2026-09-19T21:36:22 | |
| tc_0cb600c2 | search | 3ms | 2026-09-19T21:36:22 | |
| tc_b5347e82 | search | 4ms | 2026-09-19T21:36:22 | |
| tc_7d752d80 | search | 3ms | 2026-09-19T21:36:22 | |
| tc_70e29055 | search | 4ms | 2026-09-19T21:36:30 | |
| tc_8616d3c9 | search | 3ms | 2026-09-19T21:36:30 | |
| tc_3bf1dd8b | search | 4ms | 2026-09-19T21:36:34 | |
| tc_742b1e5d | search | 3ms | 2026-09-19T21:36:34 | |
| tc_6d46c336 | search | 4ms | 2026-09-19T21:36:38 | |
| tc_4d67f3db | search | 3ms | 2026-09-19T21:36:41 | |
| tc_610a09c2 | search | 3ms | 2026-09-19T21:36:41 | |
| tc_2152603b | search | 5ms | 2026-09-19T21:36:44 | |
| tc_9fb5ada6 | search | 4ms | 2026-09-19T21:36:50 | |
| tc_28a6232d | search | 3ms | 2026-09-19T21:36:50 | |
| tc_050c8386 | get_raw_output | 9ms | 2026-09-19T21:36:51 | |
| tc_fb256e38 | search | 3ms | 2026-09-19T21:36:56 | |
| tc_2db49930 | search | 4ms | 2026-09-19T21:36:59 | |
| tc_03697969 | search | 3ms | 2026-09-19T21:36:59 | |
| tc_6246e3dc | search | 4ms | 2026-09-19T21:37:02 | |
| tc_5f00583c | search | 3ms | 2026-09-19T21:37:07 | |
| tc_30b7ce5d | search | 3ms | 2026-09-19T21:37:11 | |
| tc_b34ced38 | search | 3ms | 2026-09-19T21:37:11 | |
| tc_ed470cdf | search | 4ms | 2026-09-19T21:37:14 | |
| tc_d5b32ee6 | search | 4ms | 2026-09-19T21:37:15 | |
| tc_dde8415b | search | 3ms | 2026-09-19T21:37:15 | |
| tc_dab3a73e | search | 5ms | 2026-09-19T21:37:21 | |
| tc_b8697c48 | search | 3ms | 2026-09-19T21:37:23 | |
| tc_df90153f | search | 3ms | 2026-09-19T21:37:23 | |
| tc_b86f80cd | search | 5ms | 2026-09-19T21:37:31 | |
| tc_2f848aac | search | 3ms | 2026-09-19T21:37:32 | |
| tc_4ce990a5 | search | 3ms | 2026-09-19T21:37:32 | |
| tc_62ca8c53 | search | 4ms | 2026-09-19T21:37:44 | |
| tc_a1c1e2d4 | open_case | 31ms | 2026-09-19T21:37:45 | |
| tc_5b589559 | get_investigation_summary | 6ms | 2026-09-19T21:37:46 | |
| tc_4bd5d8d1 | get_findings | 1ms | 2026-09-19T21:37:46 | |
| tc_da3388e3 | get_source_stats | 51ms | 2026-09-19T21:37:48 | |
| tc_c93a7c94 | search | 5ms | 2026-09-19T21:37:50 | |
| tc_9c8faa80 | get_raw_output | 52ms | 2026-09-19T21:37:50 | |
| tc_821a7816 | search | 5ms | 2026-09-19T21:37:53 | |
| tc_9fea7e27 | search | 3ms | 2026-09-19T21:37:53 | |
| tc_9115f045 | search | 3ms | 2026-09-19T21:37:53 | |
| tc_75dbf4fb | search | 4ms | 2026-09-19T21:38:01 | |
| tc_298e2641 | get_raw_output | 50ms | 2026-09-19T21:38:01 | |
| tc_ca8d0c97 | get_raw_output | 50ms | 2026-09-19T21:38:01 | |
| tc_ba506d51 | get_raw_output | 51ms | 2026-09-19T21:38:08 | |
| tc_f132b651 | search | 3ms | 2026-09-19T21:38:08 | |
| tc_2c206d1c | search | 9ms | 2026-09-19T21:38:08 | |
| tc_8a75dd93 | submit_finding | 11ms | 2026-09-19T21:38:10 | |
| tc_82ae7a94 | get_raw_output | 51ms | 2026-09-19T21:38:14 | |
| tc_21a3d375 | search | 3ms | 2026-09-19T21:38:21 | |
| tc_5d6d5524 | search | 2ms | 2026-09-19T21:38:21 | |
| tc_4cf14cdc | search | 2ms | 2026-09-19T21:38:21 | |
| tc_ca256a91 | submit_finding | 9ms | 2026-09-19T21:38:25 | |
| tc_e9ea20b2 | submit_finding | 11ms | 2026-09-19T21:38:40 | |
| tc_00a3d49d | search | 3ms | 2026-09-19T21:38:40 | |
| tc_79f103fb | search | 2ms | 2026-09-19T21:38:40 | |
| tc_a9077d8f | get_raw_output | 52ms | 2026-09-19T21:38:49 | |
| tc_4bf947ae | get_raw_output | 49ms | 2026-09-19T21:38:49 | |
| tc_2f145cce | submit_finding | 12ms | 2026-09-19T21:38:51 | |
| tc_c9c4f328 | search | 3ms | 2026-09-19T21:38:53 | |
| tc_efb45bca | search | 3ms | 2026-09-19T21:38:53 | |
| tc_0aa5db8e | search | 4ms | 2026-09-19T21:39:03 | |
| tc_963f105d | get_deleted_files | 180ms | 2026-09-19T21:39:04 | |
| tc_49a326c9 | search | 3ms | 2026-09-19T21:39:04 | |
| tc_14b9982a | search | 4ms | 2026-09-19T21:39:13 | |
| tc_9890d351 | search | 3ms | 2026-09-19T21:39:17 | |
| tc_7fd413a9 | search | 3ms | 2026-09-19T21:39:17 | |
| tc_68bddf21 | get_raw_output | 50ms | 2026-09-19T21:39:21 | |
| tc_fdd1328e | search | 3ms | 2026-09-19T21:39:28 | |
| tc_e3286e66 | search | 9ms | 2026-09-19T21:39:36 | |
| tc_56287e05 | search | 2ms | 2026-09-19T21:39:36 | |
| tc_04bcc422 | search | 4ms | 2026-09-19T21:39:37 | |
| tc_413e1797 | search | 5ms | 2026-09-19T21:39:43 | |
| tc_f9a13a22 | search | 4ms | 2026-09-19T21:39:43 | |
| tc_7524c845 | search | 4ms | 2026-09-19T21:39:45 | |
| tc_195b979a | search | 3ms | 2026-09-19T21:39:53 | |
| tc_8ef4498d | search | 2ms | 2026-09-19T21:39:53 | |
| tc_8df41f49 | search | 8ms | 2026-09-19T21:39:57 | |
| tc_66137e6b | search | 5ms | 2026-09-19T21:40:01 | |
| tc_32c5d2d9 | search | 3ms | 2026-09-19T21:40:01 | |
| tc_d37b89ac | submit_finding | 12ms | 2026-09-19T21:40:15 | |
| tc_d8a39d67 | get_raw_output | 51ms | 2026-09-19T21:40:16 | |
| tc_58b0fa27 | submit_finding | 12ms | 2026-09-19T21:40:23 | |
| tc_59433ce3 | search | 4ms | 2026-09-19T21:40:29 | |
| tc_c17ebfea | search | 3ms | 2026-09-19T21:40:29 | |
| tc_52c6324a | search | 3ms | 2026-09-19T21:40:29 | |
| tc_a5c41fc0 | search | 4ms | 2026-09-19T21:40:35 | |
| tc_fa1e04c4 | search | 5ms | 2026-09-19T21:40:39 | |
| tc_50c04bea | search | 3ms | 2026-09-19T21:40:39 | |
| tc_df6b9900 | search | 8ms | 2026-09-19T21:40:42 | |
| tc_f21b7dff | search | 3ms | 2026-09-19T21:40:52 | |
| tc_edd307c8 | search | 9ms | 2026-09-19T21:40:52 | |
| tc_b1efa134 | submit_finding | 0ms | 2026-09-19T21:40:53 | |
| tc_165ac613 | submit_finding | 0ms | 2026-09-19T21:41:02 | |
| tc_d039472c | submit_finding | 0ms | 2026-09-19T21:41:11 | |
| tc_5caa5a32 | search | 3ms | 2026-09-19T21:41:13 | |
| tc_186d23ba | search | 13ms | 2026-09-19T21:41:13 | |
| tc_f819d796 | submit_finding | 9ms | 2026-09-19T21:41:23 | |
| tc_06a02701 | search | 3ms | 2026-09-19T21:41:23 | |
| tc_34021213 | search | 2ms | 2026-09-19T21:41:23 | |
| tc_56570df4 | get_findings | 2ms | 2026-09-19T21:41:31 | |
| tc_5529d31f | search | 4ms | 2026-09-19T21:41:36 | |
| tc_7f3f1e9a | get_investigation_summary | 3ms | 2026-09-19T21:41:38 | |
| tc_cdf99619 | search | 7ms | 2026-09-19T21:41:45 | |
| tc_5117b64e | search | 4ms | 2026-09-19T21:41:48 | |
| tc_49aa64a2 | update_finding | 10ms | 2026-09-19T21:41:52 | |
| tc_84e61bd0 | get_findings | 2ms | 2026-09-19T21:41:57 | |
| tc_ae638b3d | update_finding | 10ms | 2026-09-19T21:41:58 | |
| tc_1b0bb627 | get_investigation_summary | 3ms | 2026-09-19T21:42:05 | |
| tc_f1292b93 | get_investigation_summary | 3ms | 2026-09-19T21:42:06 | |
| tc_1184f4e7 | search | 4ms | 2026-09-19T21:42:16 | |
| tc_f01c753b | search | 2ms | 2026-09-19T21:42:16 | |
| tc_4e70d818 | get_source_stats | 50ms | 2026-09-19T21:42:19 | |
| tc_7f55d590 | get_raw_output | 9ms | 2026-09-19T21:42:23 | |
| tc_bef4950d | search | 4ms | 2026-09-19T21:42:32 | |
| tc_e1eb6c80 | search | 4ms | 2026-09-19T21:42:32 | |
| tc_e4f12584 | get_raw_output | 51ms | 2026-09-19T21:42:33 | |
| tc_03fa1a5e | search | 72ms | 2026-09-19T21:42:41 | |
| tc_6183d751 | get_raw_output | 51ms | 2026-09-19T21:42:46 | |
| tc_c9d01f1d | get_source_stats | 51ms | 2026-09-19T21:42:53 | |
| tc_c824236c | open_case | 32ms | 2026-09-19T21:42:56 | |
| tc_5a21b790 | get_investigation_summary | 5ms | 2026-09-19T21:42:57 | |
| tc_8a274a9d | get_findings | 1ms | 2026-09-19T21:42:57 | |
| tc_d2c12d5c | get_source_stats | 51ms | 2026-09-19T21:42:58 | |
| tc_47e5985a | get_raw_output | 52ms | 2026-09-19T21:43:01 | |
| tc_ae1d8fbf | get_raw_output | 49ms | 2026-09-19T21:43:01 | |
| tc_61db37a8 | get_raw_output | 49ms | 2026-09-19T21:43:01 | |
| tc_ea0c5b61 | get_raw_output | 49ms | 2026-09-19T21:43:01 | |
| tc_9cc6e931 | get_raw_output | 49ms | 2026-09-19T21:43:01 | |
| tc_33d8c13d | track_progress | 12ms | 2026-09-19T21:43:01 | |
| tc_86bd6137 | search | 5ms | 2026-09-19T21:43:09 | |
| tc_5197bb5c | search | 3ms | 2026-09-19T21:43:09 | |
| tc_ec5059f1 | search | 3ms | 2026-09-19T21:43:09 | |
| tc_166a9f8f | get_investigation_summary | 4ms | 2026-09-19T21:43:11 | |
| tc_24b961cd | get_raw_output | 50ms | 2026-09-19T21:43:19 | |
| tc_486fa938 | get_raw_output | 50ms | 2026-09-19T21:43:19 | |
| tc_5ff0ddf0 | get_raw_output | 14ms | 2026-09-19T21:43:19 | |
| tc_4dd85a02 | search | 7ms | 2026-09-19T21:43:22 | |
| tc_bd306349 | search | 3ms | 2026-09-19T21:43:22 | |
| tc_9fc39c96 | search | 4ms | 2026-09-19T21:43:22 | |
| tc_04d3b0ef | search | 4ms | 2026-09-19T21:43:27 | |
| tc_485ae67a | search | 3ms | 2026-09-19T21:43:27 | |
| tc_7b662952 | get_raw_output | 51ms | 2026-09-19T21:43:30 | |
| tc_244bc078 | search | 4ms | 2026-09-19T21:43:33 | |
| tc_ac2ba89a | search | 3ms | 2026-09-19T21:43:33 | |
| tc_f593ddab | search | 2ms | 2026-09-19T21:43:33 | |
| tc_13946dd4 | get_raw_output | 51ms | 2026-09-19T21:43:40 | |
| tc_aa8f1189 | get_raw_output | 51ms | 2026-09-19T21:43:47 | |
| tc_26139be7 | get_raw_output | 9ms | 2026-09-19T21:43:57 | |
| tc_ce356994 | search | 5ms | 2026-09-19T21:44:00 | |
| tc_c611e113 | get_deleted_files | 135ms | 2026-09-19T21:44:10 | |
| tc_08801206 | search | 5ms | 2026-09-19T21:44:23 | |
| tc_eb68b5ed | get_raw_output | 50ms | 2026-09-19T21:44:39 | |
| tc_0d3e9cda | search | 4ms | 2026-09-19T21:44:45 | |
| tc_0c93dd19 | search | 6ms | 2026-09-19T21:44:52 | |
| tc_b8967962 | search | 3ms | 2026-09-19T21:44:58 | |
| tc_25628221 | get_raw_output | 50ms | 2026-09-19T21:45:02 | |
| tc_7888bfd3 | search | 3ms | 2026-09-19T21:45:11 | |
| tc_eb0a157c | submit_finding | 12ms | 2026-09-19T21:45:27 | |
| tc_bde7405e | submit_finding | 11ms | 2026-09-19T21:45:39 | |
| tc_d4dfb61d | get_plaso_stats | 1ms | 2026-09-19T21:45:51 | |
| tc_2db51405 | get_amcache | 2ms | 2026-09-19T21:45:56 | |
| tc_21149e6b | parse_amcache | 1ms | 2026-09-19T21:46:00 | |
| tc_f0536c67 | parse_prefetch | 1ms | 2026-09-19T21:46:04 | |
| tc_12c9e59b | parse_shimcache | 1ms | 2026-09-19T21:46:07 | |
| tc_e2c5502a | get_userassist | 1ms | 2026-09-19T21:46:11 | |
| tc_36686ca9 | parse_browser_history | 5259ms | 2026-09-19T21:46:20 | |
| tc_0edd0647 | get_raw_output | 50ms | 2026-09-19T21:46:24 | |
| tc_086e64f4 | parse_jump_lists | 1ms | 2026-09-19T21:46:29 | |
| tc_ad0f4bb5 | parse_lnk_files | 1ms | 2026-09-19T21:46:29 | |
| tc_50c4cae7 | parse_shellbags | 1ms | 2026-09-19T21:46:35 | |
| tc_3317d14e | parse_prefetch_detailed | 1ms | 2026-09-19T21:46:55 | |
| tc_58eb5793 | parse_srum | 1ms | 2026-09-19T21:46:58 | |
| tc_89d4bcf6 | get_timeline | 4ms | 2026-09-19T21:47:03 | |
| tc_2831a2d1 | get_findings | 2ms | 2026-09-19T21:47:09 | |
| tc_a86b32c4 | find_file_staging._search(tsk.filelist) | 4ms | 2026-09-19T21:47:14 | |
| tc_b3f7c858 | find_file_staging._search(ez.mft) | 3ms | 2026-09-19T21:47:14 | |
| tc_9cad7396 | find_file_staging._query(tsk.filelist) | 43ms | 2026-09-19T21:47:14 | |
| tc_21141446 | find_file_staging._query(ez.mft) | 159ms | 2026-09-19T21:47:15 | |
| tc_fbed511f | find_file_staging._search(ez.mft) | 15ms | 2026-09-19T21:47:15 | |
| tc_68e5423f | find_file_staging._search(ez.mft) | 2ms | 2026-09-19T21:47:15 | |
| tc_b2a3236e | find_file_staging | 589ms | 2026-09-19T21:47:15 | |
| tc_8a48cc9e | search | 3ms | 2026-09-19T21:48:15 | |
| tc_63090e45 | detect_timestomping | 347ms | 2026-09-19T21:48:27 | |
| tc_ab678c16 | get_raw_output | 50ms | 2026-09-19T21:48:34 | |
| tc_29a0109d | search | 4ms | 2026-09-19T21:48:49 | |
| tc_d7d45161 | search | 2ms | 2026-09-19T21:48:49 | |
| tc_03163e2b | track_progress | 9ms | 2026-09-19T21:49:03 | |
| tc_205c38fb | get_investigation_summary | 4ms | 2026-09-19T21:49:21 | |
| tc_6e4bac52 | open_case | 33ms | 2026-09-19T21:49:25 | |
| tc_fd788fed | get_findings | 3ms | 2026-09-19T21:49:25 | |
| tc_61c930c1 | get_investigation_summary | 4ms | 2026-09-19T21:49:25 | |
| tc_17df2fd4 | list_sources | 1ms | 2026-09-19T21:49:25 | |
| tc_d424ab9a | get_timeline | 24ms | 2026-09-19T21:49:28 | |
| tc_c6d10d39 | get_bookmarks | 1ms | 2026-09-19T21:49:28 | |
| tc_c754b330 | get_source_stats | 51ms | 2026-09-19T21:49:37 | |
| tc_046cdcea | open_case | 33ms | 2026-09-19T21:50:01 | |
| tc_c43cbdd7 | analyze_execution_timeline._query(ez.shimcache) | 16ms | 2026-09-19T21:50:13 | |
| tc_80469010 | analyze_execution_timeline | 38ms | 2026-09-19T21:50:13 | |
| tc_6d420e53 | find_defense_evasion._search(all) | 51ms | 2026-09-19T21:50:13 | |
| tc_28edeb27 | find_file_staging._search(tsk.filelist) | 20ms | 2026-09-19T21:50:13 | |
| tc_17885232 | reconstruct_execution_chains._query(volatility.pstree) | 50ms | 2026-09-19T21:50:13 | |
| tc_4a846f29 | find_execution_evidence._query(ez.shimcache) | 10ms | 2026-09-19T21:50:13 | |
| tc_c2200e32 | find_execution_evidence | 65ms | 2026-09-19T21:50:13 | |
| tc_53eca67f | find_defense_evasion._search(ez.mft) | 11ms | 2026-09-19T21:50:13 | |
| tc_cb1eb7b8 | find_file_staging._search(ez.mft) | 13ms | 2026-09-19T21:50:13 | |
| tc_2eda5051 | reconstruct_execution_chains._query(volatility.cmdline) | 11ms | 2026-09-19T21:50:13 | |
| tc_ac624056 | find_defense_evasion._search(all) | 15ms | 2026-09-19T21:50:13 | |
| tc_a6f16eef | reconstruct_execution_chains._query(volatility.netscan) | 43ms | 2026-09-19T21:50:13 | |
| tc_309790d6 | reconstruct_execution_chains._query(volatility.malfind) | 8ms | 2026-09-19T21:50:13 | |
| tc_ed6cd347 | reconstruct_execution_chains | 136ms | 2026-09-19T21:50:13 | |
| tc_ff036a50 | find_defense_evasion._search(all) | 52ms | 2026-09-19T21:50:13 | |
| tc_2d176526 | find_persistence_mechanisms._query(registry.system) | 61ms | 2026-09-19T21:50:13 | |
| tc_cb3dc8f3 | find_defense_evasion._search(all) | 16ms | 2026-09-19T21:50:13 | |
| tc_f314780d | find_defense_evasion | 166ms | 2026-09-19T21:50:13 | |
| tc_fa62df7f | find_lateral_movement_indicators._search(all) | 26ms | 2026-09-19T21:50:13 | |
| tc_064945c8 | find_lateral_movement_indicators._search(all) | 12ms | 2026-09-19T21:50:13 | |
| tc_2006c107 | get_eventlog_anomalies | 2ms | 2026-09-19T21:50:13 | |
| tc_0082a868 | find_lateral_movement_indicators._search(all) | 14ms | 2026-09-19T21:50:13 | |
| tc_c21433f8 | find_lateral_movement_indicators._query(volatility.netscan) | 44ms | 2026-09-19T21:50:13 | |
| tc_9cd679d9 | enrich_iocs | 351ms | 2026-09-19T21:50:13 | |
| tc_bff7eb33 | find_lateral_movement_indicators._search(all) | 14ms | 2026-09-19T21:50:13 | |
| tc_b2c4ba97 | find_lateral_movement_indicators._search(all) | 9ms | 2026-09-19T21:50:13 | |
| tc_85330573 | find_lateral_movement_indicators._search(all) | 16ms | 2026-09-19T21:50:13 | |
| tc_8cb8568c | find_lateral_movement_indicators | 152ms | 2026-09-19T21:50:13 | |
| tc_1ebbc5dc | find_persistence_mechanisms._query(registry.software) | 160ms | 2026-09-19T21:50:13 | |
| tc_e8757b43 | find_persistence_mechanisms._query(volatility.svcscan) | 49ms | 2026-09-19T21:50:13 | |
| tc_378bec4d | find_persistence_mechanisms._search(all) | 15ms | 2026-09-19T21:50:13 | |
| tc_4c52b2d9 | find_persistence_mechanisms._search(all) | 11ms | 2026-09-19T21:50:13 | |
| tc_bfd5dfb0 | find_persistence_mechanisms._query(ez.shimcache) | 10ms | 2026-09-19T21:50:13 | |
| tc_b633a062 | find_persistence_mechanisms._search(all) | 12ms | 2026-09-19T21:50:14 | |
| tc_5ebd889a | correlate_across_sources | 648ms | 2026-09-19T21:50:14 | |
| tc_7cbfdb47 | parse_usn_journal | 3ms | 2026-09-19T21:50:14 | |
| tc_9593e3b9 | parse_prefetch_detailed | 2ms | 2026-09-19T21:50:14 | |
| tc_f3f4b5c3 | correlate_across_sources | 780ms | 2026-09-19T21:50:14 | |
| tc_ca1626f3 | correlate_across_sources | 785ms | 2026-09-19T21:50:14 | |
| tc_193f29d4 | correlate_across_sources | 773ms | 2026-09-19T21:50:14 | |
| tc_d223402e | find_file_staging._query(tsk.filelist) | 775ms | 2026-09-19T21:50:14 | |
| tc_6b2f143d | find_persistence_mechanisms._query(tsk.filelist) | 637ms | 2026-09-19T21:50:14 | |
| tc_4af316c7 | find_persistence_mechanisms | 1007ms | 2026-09-19T21:50:14 | |
| tc_07e2c36f | get_deleted_files | 1060ms | 2026-09-19T21:50:14 | |
| tc_51fbd888 | detect_timestomping | 1461ms | 2026-09-19T21:50:15 | |
| tc_2d039c4a | find_file_staging._query(ez.mft) | 720ms | 2026-09-19T21:50:15 | |
| tc_3a3fb433 | find_file_staging._search(ez.mft) | 14ms | 2026-09-19T21:50:15 | |
| tc_d00feeb3 | find_file_staging._search(ez.mft) | 2ms | 2026-09-19T21:50:15 | |
| tc_2ed11ad5 | find_file_staging | 1985ms | 2026-09-19T21:50:15 | |
| tc_861c7188 | find_data_exfiltration_indicators._query(bulk.url) | 355ms | 2026-09-19T21:50:18 | |
| tc_fbd4538c | find_data_exfiltration_indicators._query(bulk.email) | 9ms | 2026-09-19T21:50:19 | |
| tc_88c0efe4 | find_data_exfiltration_indicators._query(bulk.domain) | 127ms | 2026-09-19T21:50:19 | |
| tc_058067fb | find_data_exfiltration_indicators._search(all) | 17ms | 2026-09-19T21:50:19 | |
| tc_069ac686 | find_data_exfiltration_indicators | 1488ms | 2026-09-19T21:50:19 | |
| tc_974461df | correlate_across_sources | 36ms | 2026-09-19T21:50:24 | |
| tc_7524a178 | get_eventlog_anomalies | 1ms | 2026-09-19T21:50:24 | |
| tc_371667d7 | find_data_exfiltration_indicators._query(bulk.url) | 340ms | 2026-09-19T21:50:26 | |
| tc_764dd0b7 | find_data_exfiltration_indicators._query(bulk.email) | 9ms | 2026-09-19T21:50:27 | |
| tc_73026167 | find_data_exfiltration_indicators._query(bulk.domain) | 83ms | 2026-09-19T21:50:27 | |
| tc_46360d56 | find_data_exfiltration_indicators._search(all) | 16ms | 2026-09-19T21:50:27 | |
| tc_d034af1d | find_data_exfiltration_indicators | 1430ms | 2026-09-19T21:50:27 | |
| tc_6273bb5f | find_defense_evasion._search(all) | 5ms | 2026-09-19T21:50:27 | |
| tc_3229791e | find_defense_evasion._search(ez.mft) | 3ms | 2026-09-19T21:50:27 | |
| tc_7bb1045b | find_defense_evasion._search(all) | 4ms | 2026-09-19T21:50:27 | |
| tc_1d6b80b6 | find_defense_evasion._search(all) | 9ms | 2026-09-19T21:50:27 | |
| tc_f8452b07 | find_defense_evasion._search(all) | 3ms | 2026-09-19T21:50:27 | |
| tc_2f94eb92 | find_defense_evasion | 40ms | 2026-09-19T21:50:27 | |
| tc_fe3bc283 | find_execution_evidence._query(ez.shimcache) | 6ms | 2026-09-19T21:50:29 | |
| tc_c8a2ec88 | find_execution_evidence | 11ms | 2026-09-19T21:50:29 | |
| tc_5fca9b26 | reconstruct_execution_chains._query(volatility.pstree) | 7ms | 2026-09-19T21:50:29 | |
| tc_d595be2a | reconstruct_execution_chains._query(volatility.cmdline) | 6ms | 2026-09-19T21:50:29 | |
| tc_68ce6472 | reconstruct_execution_chains._query(volatility.netscan) | 6ms | 2026-09-19T21:50:29 | |
| tc_defc7f18 | reconstruct_execution_chains._query(volatility.malfind) | 5ms | 2026-09-19T21:50:29 | |
| tc_a2a70476 | reconstruct_execution_chains | 38ms | 2026-09-19T21:50:29 | |
| tc_116945b0 | analyze_execution_timeline._query(ez.shimcache) | 6ms | 2026-09-19T21:50:42 | |
| tc_01b49a82 | analyze_execution_timeline | 10ms | 2026-09-19T21:50:42 | |
| tc_1fef4564 | find_file_staging._search(tsk.filelist) | 3ms | 2026-09-19T21:50:43 | |
| tc_11e7fa88 | find_file_staging._search(ez.mft) | 3ms | 2026-09-19T21:50:43 | |
| tc_39371796 | find_file_staging._query(tsk.filelist) | 36ms | 2026-09-19T21:50:43 | |
| tc_46051eca | find_file_staging._query(ez.mft) | 185ms | 2026-09-19T21:50:43 | |
| tc_8b5fc3a0 | find_file_staging._search(ez.mft) | 15ms | 2026-09-19T21:50:43 | |
| tc_58c17120 | find_file_staging._search(ez.mft) | 3ms | 2026-09-19T21:50:43 | |
| tc_bee896d5 | find_file_staging | 618ms | 2026-09-19T21:50:43 | |
| tc_28dc0553 | find_persistence_mechanisms._query(registry.system) | 8ms | 2026-09-19T21:50:51 | |
| tc_0dc91f12 | find_persistence_mechanisms._query(registry.software) | 11ms | 2026-09-19T21:50:51 | |
| tc_1780b064 | find_persistence_mechanisms._query(volatility.svcscan) | 6ms | 2026-09-19T21:50:51 | |
| tc_0fb5edf4 | find_persistence_mechanisms._search(all) | 6ms | 2026-09-19T21:50:51 | |
| tc_9565b4aa | find_persistence_mechanisms._search(all) | 2ms | 2026-09-19T21:50:51 | |
| tc_df59a2c5 | find_persistence_mechanisms._query(ez.shimcache) | 6ms | 2026-09-19T21:50:51 | |
| tc_eadd3f4d | find_persistence_mechanisms._search(all) | 4ms | 2026-09-19T21:50:51 | |
| tc_d2ea32a2 | find_persistence_mechanisms._query(tsk.filelist) | 35ms | 2026-09-19T21:50:51 | |
| tc_b143e88e | find_persistence_mechanisms | 138ms | 2026-09-19T21:50:51 | |
| tc_d4001621 | find_lateral_movement_indicators._search(all) | 12ms | 2026-09-19T21:50:51 | |
| tc_8528669e | find_lateral_movement_indicators._search(all) | 3ms | 2026-09-19T21:50:51 | |
| tc_504c6ebf | find_lateral_movement_indicators._search(all) | 4ms | 2026-09-19T21:50:51 | |
| tc_7b9e1c6e | find_lateral_movement_indicators._query(volatility.netscan) | 6ms | 2026-09-19T21:50:51 | |
| tc_38db7aa1 | find_lateral_movement_indicators._search(all) | 3ms | 2026-09-19T21:50:51 | |
| tc_5e957e08 | find_lateral_movement_indicators._search(all) | 3ms | 2026-09-19T21:50:51 | |
| tc_8d2ad84d | find_lateral_movement_indicators._search(all) | 4ms | 2026-09-19T21:50:51 | |
| tc_59c5bb33 | find_lateral_movement_indicators | 65ms | 2026-09-19T21:50:51 | |
| tc_58c0cde2 | detect_timestomping | 290ms | 2026-09-19T21:51:11 | |
| tc_81e08028 | get_deleted_files | 159ms | 2026-09-19T21:51:11 | |
| tc_e00b5fe0 | parse_usn_journal | 1ms | 2026-09-19T21:51:15 | |
| tc_1ccc64bf | parse_prefetch_detailed | 1ms | 2026-09-19T21:51:15 | |
| tc_543f7ac9 | correlate_across_sources | 44ms | 2026-09-19T21:51:22 | |
| tc_d5824571 | enrich_iocs | 33ms | 2026-09-19T21:51:22 | |
| tc_7cf3aa36 | open_case | 34ms | 2026-09-19T21:51:46 | |
| tc_c751020e | get_investigation_summary | 5ms | 2026-09-19T21:51:47 | |
| tc_667e9f27 | get_findings | 2ms | 2026-09-19T21:51:47 | |
| tc_ee9f2ce2 | list_sources | 2ms | 2026-09-19T21:51:49 | |
| tc_9f1df645 | get_raw_output | 52ms | 2026-09-19T21:51:52 | |
| tc_cc1fbacd | get_raw_output | 50ms | 2026-09-19T21:51:52 | |
| tc_b86eb0e4 | search | 5ms | 2026-09-19T21:52:21 | |
| tc_c6a26d98 | search | 2ms | 2026-09-19T21:52:21 | |
| tc_7f0706de | search | 2ms | 2026-09-19T21:52:21 | |
| tc_d9fff91f | search | 4ms | 2026-09-19T21:52:29 | |
| tc_815234ca | search | 2ms | 2026-09-19T21:52:29 | |
| tc_4d2da5bd | search | 2ms | 2026-09-19T21:52:29 | |
| tc_a3fa5ba7 | search | 3ms | 2026-09-19T21:52:32 | |
| tc_221c0bdb | search | 2ms | 2026-09-19T21:52:32 | |
| tc_5306aa1f | search | 2ms | 2026-09-19T21:52:32 | |
| tc_121040ae | get_raw_output | 52ms | 2026-09-19T21:52:36 | |
| tc_fbc9a612 | search | 3ms | 2026-09-19T21:52:36 | |
| tc_49958ffa | search | 2ms | 2026-09-19T21:52:36 | |
| tc_772a898b | search | 4ms | 2026-09-19T21:52:40 | |
| tc_2554dc66 | search | 3ms | 2026-09-19T21:52:40 | |
| tc_5fdf1ff6 | search | 9ms | 2026-09-19T21:52:48 | |
| tc_c3846257 | search | 5ms | 2026-09-19T21:52:48 | |
| tc_3f858730 | get_ioc_summary | 524ms | 2026-09-19T21:52:52 | |
| tc_a01692be | search | 3ms | 2026-09-19T21:52:52 | |
| tc_5a04eaba | search | 3ms | 2026-09-19T21:52:59 | |
| tc_3075a1b7 | search | 2ms | 2026-09-19T21:52:59 | |
| tc_5ba411f6 | search | 5ms | 2026-09-19T21:53:12 | |
| tc_9a9ba69b | search | 2ms | 2026-09-19T21:53:12 | |
| tc_15b06c40 | search | 4ms | 2026-09-19T21:53:21 | |
| tc_d6afc8e7 | search | 3ms | 2026-09-19T21:53:21 | |
| tc_f6a993a7 | get_deleted_files | 176ms | 2026-09-19T21:53:30 | |
| tc_1a550a01 | search | 6ms | 2026-09-19T21:53:30 | |
| tc_aeda6482 | search | 5ms | 2026-09-19T21:53:37 | |
| tc_c464f30f | search | 4ms | 2026-09-19T21:53:37 | |
| tc_344ae083 | search | 3ms | 2026-09-19T21:53:47 | |
| tc_fbdf6b7c | search | 3ms | 2026-09-19T21:53:47 | |
| tc_ee9fbc81 | get_raw_output | 50ms | 2026-09-19T21:53:57 | |
| tc_819aca3f | get_raw_output | 49ms | 2026-09-19T21:53:57 | |
| tc_bdb37a7f | search | 7ms | 2026-09-19T21:54:04 | |
| tc_e7103e67 | search | 25ms | 2026-09-19T21:54:04 | |
| tc_7886bef7 | search | 3ms | 2026-09-19T21:54:10 | |
| tc_73729f3c | search | 3ms | 2026-09-19T21:54:10 | |
| tc_53d79c8a | search | 3ms | 2026-09-19T21:54:16 | |
| tc_083c94ed | search | 3ms | 2026-09-19T21:54:16 | |
| tc_fee85734 | get_raw_output | 52ms | 2026-09-19T21:54:26 | |
| tc_90e65608 | get_raw_output | 51ms | 2026-09-19T21:54:26 | |
| tc_c29c25ce | parse_prefetch | 1ms | 2026-09-19T21:54:35 | |
| tc_0826dcb5 | search | 3ms | 2026-09-19T21:54:35 | |
| tc_c8643463 | get_raw_output | 51ms | 2026-09-19T21:54:43 | |
| tc_5e2f329d | get_raw_output | 51ms | 2026-09-19T21:54:43 | |
| tc_285fc265 | get_raw_output | 51ms | 2026-09-19T21:54:50 | |
| tc_24c87c99 | search | 3ms | 2026-09-19T21:54:50 | |
| tc_2701c2e4 | get_raw_output | 6ms | 2026-09-19T21:54:57 | |
| tc_097e5b67 | get_raw_output | 51ms | 2026-09-19T21:55:04 | |
| tc_24e07233 | search | 3ms | 2026-09-19T21:55:16 | |
| tc_aefb3fa3 | get_raw_output | 7ms | 2026-09-19T21:55:24 | |
| tc_bbfb8a71 | search | 4ms | 2026-09-19T21:55:33 | |
| tc_86517227 | get_raw_output | 6ms | 2026-09-19T21:55:39 | |
| tc_06c486c8 | search | 3ms | 2026-09-19T21:55:53 | |
| tc_5d38c811 | search | 3ms | 2026-09-19T21:56:00 | |
| tc_799f17c1 | get_raw_output | 51ms | 2026-09-19T21:56:15 | |
| tc_c2c344cc | get_raw_output | 51ms | 2026-09-19T21:56:24 | |
| tc_d55999e5 | get_raw_output | 51ms | 2026-09-19T21:56:38 | |
| tc_ba67b675 | get_raw_output | 6ms | 2026-09-19T21:56:49 | |
| tc_01e2e3ef | search | 3ms | 2026-09-19T21:56:59 | |
| tc_1b5335c6 | get_raw_output | 6ms | 2026-09-19T21:57:12 | |
| tc_639d70fa | search | 3ms | 2026-09-19T21:57:24 | |
| tc_92f780d9 | get_raw_output | 6ms | 2026-09-19T21:57:40 | |
| tc_4bf1fab6 | search | 3ms | 2026-09-19T21:57:57 | |
| tc_6756e319 | get_raw_output | 6ms | 2026-09-19T21:58:17 | |
| tc_1de02326 | search | 3ms | 2026-09-19T21:58:28 | |
| tc_0f88a063 | get_raw_output | 6ms | 2026-09-19T21:58:39 | |
| tc_70434a32 | search | 3ms | 2026-09-19T21:58:49 | |
| tc_cea487cd | get_raw_output | 6ms | 2026-09-19T21:58:59 | |
| tc_26f7236e | search | 3ms | 2026-09-19T21:59:08 | |
| tc_6e50e4ed | open_case | 33ms | 2026-09-19T21:59:16 | |
| tc_9ae26175 | get_investigation_summary | 5ms | 2026-09-19T21:59:17 | |
| tc_6a82f75f | get_findings | 1ms | 2026-09-19T21:59:17 | |
| tc_a2013501 | get_source_stats | 58ms | 2026-09-19T21:59:21 | |
| tc_2b5c4340 | get_bookmarks | 1ms | 2026-09-19T21:59:21 | |
| tc_d3ccc881 | get_ioc_summary | 535ms | 2026-09-19T21:59:21 | |
| tc_9a7a820a | get_raw_output | 54ms | 2026-09-19T21:59:29 | |
| tc_3b74d250 | get_raw_output | 51ms | 2026-09-19T21:59:30 | |
| tc_da785bae | search | 5ms | 2026-09-19T21:59:40 | |
| tc_ad3552d2 | get_raw_output | 51ms | 2026-09-19T21:59:47 | |
| tc_1c694b25 | get_raw_output | 50ms | 2026-09-19T21:59:57 | |
| tc_bcc55a7c | search | 5ms | 2026-09-19T22:00:05 | |
| tc_90abf847 | search | 5ms | 2026-09-19T22:00:05 | |
| tc_41e228b6 | search | 10ms | 2026-09-19T22:00:10 | |
| tc_1aa1478b | get_raw_output | 50ms | 2026-09-19T22:00:10 | |
| tc_ec050e5c | search | 6ms | 2026-09-19T22:00:15 | |
| tc_178c6900 | get_raw_output | 50ms | 2026-09-19T22:00:15 | |
| tc_b0143984 | search | 6ms | 2026-09-19T22:00:28 | |
| tc_6cbea3f5 | search | 28ms | 2026-09-19T22:00:28 | |
| tc_dc3ef62a | search | 4ms | 2026-09-19T22:00:40 | |
| tc_5ac3b539 | get_deleted_files | 133ms | 2026-09-19T22:00:40 | |
| tc_9273c310 | search | 3ms | 2026-09-19T22:01:01 | |
| tc_7f0ac813 | search | 3ms | 2026-09-19T22:01:01 | |
| tc_fc8b5e46 | update_finding | 3ms | 2026-09-19T22:01:08 | |
| tc_bd932545 | update_finding | 2ms | 2026-09-19T22:01:17 | |
| tc_1abdee6f | update_finding | 3ms | 2026-09-19T22:01:23 | |
| tc_fe7d930a | update_finding | 2ms | 2026-09-19T22:01:33 | |
| tc_62eaba8d | update_finding | 2ms | 2026-09-19T22:01:44 | |
| tc_0ab1724c | update_finding | 2ms | 2026-09-19T22:01:56 | |
| tc_1cdf5aae | update_finding | 2ms | 2026-09-19T22:02:05 | |
| tc_1f0c1b89 | update_finding | 2ms | 2026-09-19T22:02:15 | |
| tc_e304e794 | update_finding | 2ms | 2026-09-19T22:02:20 | |
| tc_6ecdf6a4 | update_finding | 2ms | 2026-09-19T22:02:28 | |
| tc_220c01d0 | submit_finding | 17ms | 2026-09-19T22:02:50 | |
| tc_9b963d2a | track_progress | 13ms | 2026-09-19T22:02:58 | |
| tc_e0fe4c8c | get_findings | 1ms | 2026-09-19T22:03:24 | |
| tc_8dffe4a1 | get_investigation_summary | 4ms | 2026-09-19T22:03:37 | |
| tc_87e94fa0 | open_case | 35ms | 2026-09-19T22:03:40 | |
| tc_a3666ebf | get_findings | 3ms | 2026-09-19T22:03:41 | |
| tc_26cc1162 | get_investigation_summary | 5ms | 2026-09-19T22:03:42 | |
| tc_7764a6b4 | list_sources | 2ms | 2026-09-19T22:03:43 | |
| tc_2d51cf6d | get_timeline | 25ms | 2026-09-19T22:03:45 | |
| tc_87df9d07 | get_timeline | 2ms | 2026-09-19T22:03:52 | |
| tc_99f44836 | get_timeline | 1ms | 2026-09-19T22:04:04 | |
| tc_98aab99a | get_timeline | 4ms | 2026-09-19T22:04:08 | |
| tc_88ad5753 | get_timeline | 2ms | 2026-09-19T22:04:13 | |
| tc_dfb9128e | get_timeline | 5ms | 2026-09-19T22:04:20 | |
| tc_c4634de7 | get_timeline | 2ms | 2026-09-19T22:04:26 | |
| tc_94400103 | get_timeline | 13ms | 2026-09-19T22:04:33 | |
| tc_6b7f0207 | get_timeline | 1ms | 2026-09-19T22:04:47 | |
| tc_53358e90 | get_timeline | 1ms | 2026-09-19T22:04:57 | |
| tc_aa51dca8 | get_timeline | 3ms | 2026-09-19T22:05:04 | |
| tc_7795e021 | open_case | 35ms | 2026-09-19T22:05:29 | |
| tc_c7105990 | search | 11ms | 2026-09-19T22:05:31 | |
| tc_85ab2105 | search | 22ms | 2026-09-19T22:05:31 | |
| tc_515db926 | search | 17ms | 2026-09-19T22:05:31 | |
| tc_9a3ddff2 | search | 12ms | 2026-09-19T22:05:31 | |
| tc_660507aa | search | 19ms | 2026-09-19T22:05:31 | |
| tc_b4981322 | search | 20ms | 2026-09-19T22:05:31 | |
| tc_76f0e0f2 | correlate_across_sources | 59ms | 2026-09-19T22:05:34 | |
| tc_a8dc9d3d | get_raw_output | 65ms | 2026-09-19T22:05:34 | |
| tc_8593b3f1 | correlate_across_sources | 69ms | 2026-09-19T22:05:34 | |
| tc_ef209885 | correlate_across_sources | 80ms | 2026-09-19T22:05:34 | |
| tc_db54c874 | correlate_across_sources | 89ms | 2026-09-19T22:05:34 | |
| tc_b272f841 | detect_timestomping | 400ms | 2026-09-19T22:05:35 | |
| tc_b4b43d56 | search | 12ms | 2026-09-19T22:05:36 | |
| tc_d6b9ed17 | search | 19ms | 2026-09-19T22:05:36 | |
| tc_4360b0b1 | search | 16ms | 2026-09-19T22:05:36 | |
| tc_425e8ee3 | search | 19ms | 2026-09-19T22:05:36 | |
| tc_08ff6919 | search | 20ms | 2026-09-19T22:05:36 | |
| tc_c6b7e08b | search | 14ms | 2026-09-19T22:05:36 | |
| tc_891d693b | search | 9ms | 2026-09-19T22:05:38 | |
| tc_e14d1ccf | search | 11ms | 2026-09-19T22:05:38 | |
| tc_28667b71 | search | 12ms | 2026-09-19T22:05:38 | |
| tc_4e452648 | search | 10ms | 2026-09-19T22:05:38 | |
| tc_767d6c59 | search | 13ms | 2026-09-19T22:05:38 | |
| tc_71cc9605 | get_raw_output | 57ms | 2026-09-19T22:05:38 | |
| tc_0f647eff | search | 12ms | 2026-09-19T22:05:41 | |
| tc_d588037a | search | 13ms | 2026-09-19T22:05:41 | |
| tc_8f08c55d | search | 12ms | 2026-09-19T22:05:41 | |
| tc_9eba2e20 | search | 9ms | 2026-09-19T22:05:41 | |
| tc_76bbd6ba | get_raw_output | 54ms | 2026-09-19T22:05:41 | |
| tc_df48baf7 | get_raw_output | 53ms | 2026-09-19T22:05:41 | |
| tc_bd79cf33 | search | 9ms | 2026-09-19T22:05:44 | |
| tc_0758edc3 | get_raw_output | 60ms | 2026-09-19T22:05:44 | |
| tc_83b296f1 | get_raw_output | 57ms | 2026-09-19T22:05:44 | |
| tc_c068757d | get_raw_output | 60ms | 2026-09-19T22:05:44 | |
| tc_b9fbbe1d | get_raw_output | 69ms | 2026-09-19T22:05:44 | |
| tc_446d4ee1 | get_raw_output | 69ms | 2026-09-19T22:05:44 | |
| tc_9df8cc6c | search | 13ms | 2026-09-19T22:05:46 | |
| tc_fae989ae | search | 11ms | 2026-09-19T22:05:46 | |
| tc_bd435b31 | search | 14ms | 2026-09-19T22:05:46 | |
| tc_183c7a9e | search | 17ms | 2026-09-19T22:05:46 | |
| tc_3c3e4895 | get_raw_output | 14ms | 2026-09-19T22:05:46 | |
| tc_4f655f65 | get_raw_output | 54ms | 2026-09-19T22:05:46 | |
| tc_fe12e9cb | search | 8ms | 2026-09-19T22:05:49 | |
| tc_fc866ae6 | search | 7ms | 2026-09-19T22:05:49 | |
| tc_8859dddb | get_raw_output | 57ms | 2026-09-19T22:05:49 | |
| tc_49c090c7 | get_raw_output | 59ms | 2026-09-19T22:05:49 | |
| tc_9c6ac7f1 | get_raw_output | 61ms | 2026-09-19T22:05:49 | |
| tc_310357b4 | get_raw_output | 60ms | 2026-09-19T22:05:49 | |
| tc_48c49c32 | get_raw_output | 12ms | 2026-09-19T22:05:52 | |
| tc_8775bfe1 | get_raw_output | 12ms | 2026-09-19T22:05:52 | |
| tc_700c3c9f | get_raw_output | 56ms | 2026-09-19T22:05:52 | |
| tc_52a896d0 | get_raw_output | 55ms | 2026-09-19T22:05:52 | |
| tc_fb58028f | get_raw_output | 54ms | 2026-09-19T22:05:52 | |
| tc_e8de51f2 | get_raw_output | 53ms | 2026-09-19T22:05:57 | |
| tc_b6770ab4 | search | 7ms | 2026-09-19T22:06:00 | |
| tc_78514576 | search | 6ms | 2026-09-19T22:06:00 | |
| tc_67af688b | search | 50ms | 2026-09-19T22:06:00 | |
| tc_26926c96 | get_raw_output | 53ms | 2026-09-19T22:06:00 | |
| tc_f48d79f5 | get_raw_output | 50ms | 2026-09-19T22:06:00 | |
| tc_3f873332 | get_raw_output | 55ms | 2026-09-19T22:06:00 | |
| tc_add6eed3 | search | 9ms | 2026-09-19T22:06:03 | |
| tc_428f3fe9 | search | 10ms | 2026-09-19T22:06:03 | |
| tc_50e4b8d4 | search | 12ms | 2026-09-19T22:06:03 | |
| tc_ae0ba233 | search | 20ms | 2026-09-19T22:06:03 | |
| tc_e71a5c6b | get_raw_output | 54ms | 2026-09-19T22:06:03 | |
| tc_ff2b6cb0 | get_raw_output | 56ms | 2026-09-19T22:06:03 | |
| tc_8323a92d | search | 6ms | 2026-09-19T22:06:13 | |
| tc_2745ea9a | search | 5ms | 2026-09-19T22:06:13 | |
| tc_642c3698 | search | 8ms | 2026-09-19T22:06:13 | |
| tc_0574c93b | search | 13ms | 2026-09-19T22:06:13 | |
| tc_8cf9ea2f | search | 20ms | 2026-09-19T22:06:13 | |
| tc_c0ab35e6 | get_raw_output | 52ms | 2026-09-19T22:06:13 | |
| tc_6dacfb7e | search | 9ms | 2026-09-19T22:06:16 | |
| tc_5b862539 | search | 8ms | 2026-09-19T22:06:16 | |
| tc_9bed550a | search | 11ms | 2026-09-19T22:06:16 | |
| tc_1a45d782 | search | 17ms | 2026-09-19T22:06:16 | |
| tc_42f915d3 | search | 24ms | 2026-09-19T22:06:16 | |
| tc_74f9eb3b | get_raw_output | 56ms | 2026-09-19T22:06:16 | |
| tc_1ef2b503 | open_case | 35ms | 2026-09-19T22:06:35 | |
| tc_2dcc2bf9 | get_findings | 2ms | 2026-09-19T22:06:36 | |
| tc_47931bbe | get_investigation_summary | 4ms | 2026-09-19T22:06:36 | |
| tc_02b4d1e9 | search | 7ms | 2026-09-19T22:06:37 | |
| tc_717024da | search | 3ms | 2026-09-19T22:06:37 | |
| tc_10dff308 | search | 3ms | 2026-09-19T22:06:39 | |
| tc_ad05c4e9 | search | 2ms | 2026-09-19T22:06:39 | |
| tc_602314fd | search | 4ms | 2026-09-19T22:06:41 | |
| tc_92f40134 | search | 2ms | 2026-09-19T22:06:41 | |
| tc_fefeee18 | search | 3ms | 2026-09-19T22:06:42 | |
| tc_fd3c10ac | search | 3ms | 2026-09-19T22:06:42 | |
| tc_4dabccd7 | search | 5ms | 2026-09-19T22:06:44 | |
| tc_3d00e707 | search | 3ms | 2026-09-19T22:06:47 | |
| tc_cf425c56 | search | 3ms | 2026-09-19T22:06:47 | |
| tc_1d6db87d | search | 3ms | 2026-09-19T22:06:50 | |
| tc_7bf04622 | search | 3ms | 2026-09-19T22:06:50 | |
| tc_d940d870 | get_raw_output | 51ms | 2026-09-19T22:06:52 | |
| tc_3dc41dd7 | search | 6ms | 2026-09-19T22:07:03 | |
| tc_1c72d46c | search | 4ms | 2026-09-19T22:07:03 | |
| tc_ba0d5828 | search | 3ms | 2026-09-19T22:07:06 | |
| tc_4e415b3e | search | 3ms | 2026-09-19T22:07:06 | |
| tc_3b2b7eaa | search | 5ms | 2026-09-19T22:07:10 | |
| tc_0a64f9d6 | search | 3ms | 2026-09-19T22:07:10 | |
| tc_33c2824e | search | 4ms | 2026-09-19T22:07:15 | |
| tc_745d3f25 | search | 3ms | 2026-09-19T22:07:15 | |
| tc_bd683900 | get_raw_output | 51ms | 2026-09-19T22:07:21 | |
| tc_939310df | search | 4ms | 2026-09-19T22:07:26 | |
| tc_0bac1acc | search | 3ms | 2026-09-19T22:07:26 | |
| tc_8978eb22 | search | 5ms | 2026-09-19T22:07:32 | |
| tc_3db5c964 | search | 3ms | 2026-09-19T22:07:32 | |
| tc_6cf85f87 | search | 4ms | 2026-09-19T22:07:39 | |
| tc_e482cdc0 | search | 3ms | 2026-09-19T22:07:39 | |
| tc_a81e38f9 | search | 4ms | 2026-09-19T22:07:44 | |
| tc_9f0e8aeb | search | 3ms | 2026-09-19T22:07:44 | |
| tc_5d9d07ae | search | 3ms | 2026-09-19T22:07:49 | |
| tc_a29ce1cb | search | 3ms | 2026-09-19T22:07:49 | |
| tc_4752557c | search | 4ms | 2026-09-19T22:07:55 | |
| tc_4c3abf93 | search | 3ms | 2026-09-19T22:07:55 | |
| tc_963b6e7f | search | 4ms | 2026-09-19T22:08:00 | |
| tc_f87ed19e | search | 3ms | 2026-09-19T22:08:00 | |
| tc_fa50bb69 | search | 3ms | 2026-09-19T22:08:10 | |
| tc_b2b0c479 | search | 3ms | 2026-09-19T22:08:10 | |
| tc_3d30b91a | search | 4ms | 2026-09-19T22:08:16 | |
| tc_8521ab07 | search | 3ms | 2026-09-19T22:08:21 | |
| tc_ac4d5bbb | search | 3ms | 2026-09-19T22:08:21 | |
| tc_b571d100 | search | 3ms | 2026-09-19T22:08:28 | |
| tc_dcfb7f65 | search | 3ms | 2026-09-19T22:08:33 | |
| tc_1369fd3b | search | 3ms | 2026-09-19T22:08:33 | |
| tc_dd254613 | search | 3ms | 2026-09-19T22:08:40 | |
| tc_1a9a958d | search | 3ms | 2026-09-19T22:08:48 | |
| tc_8bc3ebb5 | search | 3ms | 2026-09-19T22:08:48 | |
| tc_ceef3fc1 | search | 3ms | 2026-09-19T22:08:54 | |
| tc_04db45c6 | search | 5ms | 2026-09-19T22:09:01 | |
| tc_55ccd0b7 | search | 3ms | 2026-09-19T22:09:01 | |
| tc_d07b6b37 | search | 3ms | 2026-09-19T22:09:10 | |
| tc_237dd31f | search | 3ms | 2026-09-19T22:09:17 | |
| tc_cd639f5b | search | 3ms | 2026-09-19T22:09:17 | |
| tc_eace375a | search | 4ms | 2026-09-19T22:09:24 | |
| tc_c40d0a4f | search | 3ms | 2026-09-19T22:09:30 | |
| tc_6d2045fc | search | 3ms | 2026-09-19T22:09:30 | |
| tc_fbebe1f2 | open_case | 36ms | 2026-09-19T22:09:44 | |
| tc_de509822 | get_investigation_summary | 6ms | 2026-09-19T22:09:46 | |
| tc_98ccfbe7 | get_findings | 1ms | 2026-09-19T22:09:46 | |
| tc_53268144 | audit_evidence_coverage | 50ms | 2026-09-19T22:09:55 | |
| tc_0f0fb773 | audit_tool_coverage | 1ms | 2026-09-19T22:09:55 | |
| tc_fa37c3af | deduplicate_findings | 22ms | 2026-09-19T22:09:55 | |
| tc_08422357 | search | 5ms | 2026-09-19T22:10:46 | |
| tc_64a2aee8 | get_raw_output | 52ms | 2026-09-19T22:10:46 | |
| tc_ecc36986 | search | 4ms | 2026-09-19T22:10:59 | |
| tc_08088a01 | search | 2ms | 2026-09-19T22:10:59 | |
| tc_9e68ed08 | get_raw_output | 50ms | 2026-09-19T22:11:07 | |
| tc_33a6aaf8 | search | 7ms | 2026-09-19T22:11:14 | |
| tc_82aacf24 | search | 3ms | 2026-09-19T22:11:14 | |
| tc_11300a2a | submit_finding | 18ms | 2026-09-19T22:11:40 | |
| tc_89590ad8 | update_finding | 14ms | 2026-09-19T22:11:50 | |
| tc_2c00a6b4 | delete_finding | 10ms | 2026-09-19T22:11:55 | |
| tc_7a5018f3 | update_finding | 13ms | 2026-09-19T22:12:04 | |
| tc_3b4b5100 | delete_finding | 11ms | 2026-09-19T22:12:12 | |
| tc_799299f8 | update_finding | 13ms | 2026-09-19T22:12:20 | |
| tc_ad20624c | delete_finding | 11ms | 2026-09-19T22:12:32 | |
| tc_9b39c44d | update_finding | 14ms | 2026-09-19T22:12:44 | |
| tc_b9ec8fd8 | delete_finding | 11ms | 2026-09-19T22:12:52 | |
| tc_aca542d9 | delete_finding | 11ms | 2026-09-19T22:12:52 | |
| tc_a35ff202 | update_finding | 14ms | 2026-09-19T22:13:00 | |
| tc_988a7f5b | delete_finding | 11ms | 2026-09-19T22:13:05 | |
| tc_7d8b42a3 | get_findings | 1ms | 2026-09-19T22:13:16 | |
| tc_d88b8b3a | check_finalize_readiness | 3ms | 2026-09-19T22:13:16 | |
| tc_9d329ef5 | search | 4ms | 2026-09-19T22:13:25 | |
| tc_bbb68dde | track_progress | 15ms | 2026-09-19T22:13:40 | |
| tc_5bc4de5e | get_investigation_summary | 4ms | 2026-09-19T22:13:56 | |
| tc_ec87b283 | check_finalize_readiness | 4ms | 2026-09-19T22:13:56 | |
| tc_dbfca270 | open_case | 13ms | 2026-09-19T22:14:01 | |
| tc_736c20fb | get_investigation_summary | 8ms | 2026-09-19T22:14:02 | |
| tc_e5cd10f3 | get_findings | 1ms | 2026-09-19T22:14:02 | |
| tc_bc8c3d9e | get_ioc_summary | 533ms | 2026-09-19T22:14:03 | |
| tc_3ce8a183 | get_bookmarks | 1ms | 2026-09-19T22:14:03 | |
| tc_68b10f51 | get_source_stats | 52ms | 2026-09-19T22:14:03 | |
| tc_346642f4 | audit_evidence_coverage | 47ms | 2026-09-19T22:14:06 | |
| tc_ac2e9a43 | audit_tool_coverage | 1ms | 2026-09-19T22:14:06 | |
| tc_7f6ec19b | submit_narrative | 12ms | 2026-09-19T22:14:43 | |
| tc_8dcd8028 | check_finalize_readiness | 4ms | 2026-09-19T22:14:54 |
Each finding traces back to the specific tool calls that produced the supporting evidence.