Investigation Dashboard
The attack timeline spans 2015-02-15 to 2015-03-25. The earliest activity was USB Device Exfiltration Timeline — Three Devices with IAMAN Labels (2015-02-15). The investigation subsequently uncovered Complete Incident Execution Timeline — March 22-25, 2015; Network File Server Access — \\10.11.11.128\secured_drive\Secret Project Data; Google Drive Sync Active After Anti-Forensic Cleanup — Possible Ongoing Cloud Exfiltration. The most recent activity was Google Drive Sync Active After Anti-Forensic Cleanup — Possible Ongoing Cloud Exfiltration (2015-03-25).
- Insider Threat Actor Identified — Suspect "Iaman Informant"
- Secret Project Documents Accessed and Staged for Exfiltration
- Multi-Vector Exfiltration — USB Drives, CD-R, Google Drive, and iCloud
- Government Agency Documents Exfiltrated — NASA, NIH, Library of Congress, DOE
- Network File Server Access — \\10.11.11.128\secured_drive\Secret Project Data
- Insider Threat Actor Identified — Suspect "Iaman Informant"
- Secret Project Documents Accessed and Staged for Exfiltration
- Multi-Vector Exfiltration — USB Drives, CD-R, Google Drive, and iCloud
- Government Agency Documents Exfiltrated — NASA, NIH, Library of Congress, DOE
-
Network File Server Access — \\10.11.11.128\secured_drive\Secret Project Data
2015-03-22T14:52:21Z
- Suspect Fully Identified — iaman.informant@nist.gov, NIST Employee
-
USB Device Exfiltration Timeline — Three Devices with IAMAN Labels
2015-02-15T21:52:08Z — 2015-03-24T20:40:55Z
-
Complete Incident Execution Timeline — March 22-25, 2015
2015-02-15T21:52:08Z — 2015-03-25T15:28:33Z
-
Google Drive Sync Active After Anti-Forensic Cleanup — Possible Ongoing Cloud Exfiltration
2015-03-25T15:21:40Z
| Case ID | nist-data-leakage |
| Evidence Root | /evidence/nist-data-leakage |
| Report Generated | 2026-04-20T19:30:08 |
| Investigation Start | 2026-04-20T18:56:02 |
| Investigation End | 2026-04-20T19:29:44 |
| Total Processing | 1236.8s |
| Audit Log | /root/.mulder/cases/nist-data-leakage.audit.jsonl |
Evidence Hashes
sha256sum <file>| File | SHA-256 | Size |
|---|---|---|
| cfreds_2015_data_leakage_pc.E01 | e6365e44f1004252171acb73e6779be05277cbd57d09d7febed22d2463a956a9 | 2.0 GB |
| cfreds_2015_data_leakage_rm1.E01 | a14150a21bc1e3700b51912c2ab20cd9587ad3e27ee67475af64508a7e760121 | 74.6 MB |
| cfreds_2015_data_leakage_rm2.E01 | 25215f9bcb51ceee9147886ed3f5c13ef148de634fc5114491e0f8dad8b15696 | 243.2 MB |
| cfreds_2015_data_leakage_rm3.E01 | 336e1307721ef5f63679379961d1716b74f986e69df8c40117d9cea7858d512b | 90.2 MB |
Investigation Report
NIST Data Leakage Investigation — Incident Report
Case ID: nist-data-leakage
Evidence: 4 disk images (1 PC + 3 removable media)
Investigation Date: 2026-04-20
Classification: Insider Threat / Data Exfiltration
Background
The National Institute of Standards and Technology (NIST) submitted four forensic disk images for examination following the suspected unauthorized exfiltration of confidential project data by a departing employee. The evidence consists of a primary Windows 7 workstation image (7.3 GB across four EWF segments) and three removable media devices: a USB exFAT drive (74.6 MB, labeled "Authorized USB"), a USB FAT32 drive (243.2 MB, labeled "IAMAN $_@"), and a CD-R disc (90.2 MB, labeled "IAMAN CD"). The evidence was examined using The Sleuth Kit filesystem analysis, bulk_extractor IOC carving, Windows Prefetch analysis, and LNK file artifact recovery.
Incident Timeline
December 2014 — Earliest Data Staging
The earliest evidence of data preparation dates to December 2014. LNK artifacts recovered from the PC show that a file named winter_whether_advisory.zip was created on the exFAT USB ("Authorized USB") with a write time of 2014-12-16T16:10:26Z, and [secret_project]_proposal.docx was present on the same USB with a write time of 2014-12-19T19:53:46Z. This establishes that the suspect began gathering confidential project materials at least three months before their departure.
February 15, 2015 — First Documented USB Exfiltration
On February 15, 2015 at approximately 21:52 UTC, the suspect accessed the exFAT USB drive (RM1, "Authorized USB") via drive letter E:, navigating to the path E:\RM#1\Secret Project Data\proposal\ and opening [secret_project]_proposal.docx. Multiple LNK artifacts corroborate this access event, with timestamps at 21:52:08, 21:52:12, and 21:52:20 UTC. This represents the first directly evidenced exfiltration event.
March 22, 2015 — Primary Exfiltration Day
The most significant data access activity occurred on March 22, 2015. MFT records recovered via bulk_extractor show that the "informant" user account directory was created at 14:34:31 UTC — indicating the account may have been newly established as a dedicated exfiltration identity on this date.
Between 14:52:08 and 14:52:21 UTC, the suspect accessed the organizational network file share \\10.11.11.128\secured_drive (mounted as drive V:), navigating to Secret Project Data\final and accessing (secret_project)_pricing_decision.xlsx. This network server, at internal IP 10.11.11.128, hosted the confidential "Secret Project" repository.
At 15:03:23 UTC, Microsoft Outlook was opened under the email address iaman.informant@nist.gov, connecting to NIST's Microsoft Exchange Online (Office 365) environment. Google Chrome was opened multiple times between 15:11 and 15:16 UTC. At 15:54 UTC, artifacts from the admin11 account Quick Launch were accessed, and at 15:56 UTC, the temporary user account's Quick Launch and Internet Explorer entries were accessed — suggesting the suspect may have briefly used alternate accounts.
March 24, 2015 — Final Media Exfiltration
On March 24, 2015, the suspect engaged in final media exfiltration activities. Internet Explorer was launched at 14:05 UTC (12 cumulative runs). The Volume Shadow Copy Service (VSSVC.EXE) ran at 15:21 UTC (4 runs). Sticky Notes (STIKYNOT.EXE) ran at 18:31 UTC (2 runs), and Microsoft Word (WINWORD.EXE) was used to create the resignation letter Resignation_Letter_(Iaman_Informant).docx, with access at 18:48 UTC and editing at 18:59 UTC.
Between 20:40 and 21:02 UTC, both the FAT32 USB (RM2, "IAMAN $_@") and the CD-R disc (RM3, "IAMAN CD") were accessed at drive letters E: and D: respectively. The file winter_whether_advisory.zip was accessed on the FAT32 USB at 20:40 UTC, and the CD-R was browsed including D:\Koala.jpg at 20:57 UTC. The DEVICEDISPLAYOBJECTPROVIDER.EXE prefetch entry at 21:02 UTC confirms USB device interaction.
March 25, 2015 — Anti-Forensic Cleanup and Departure
The final day of activity was devoted to systematic anti-forensic evidence destruction before the suspect's departure from NIST.
At 10:18 UTC, CLRGC.EXE (the .NET CLR garbage collector) ran three times — consistent with Google Drive Sync operating in the background during early morning hours.
At 14:31 UTC, CONHOST.EXE ran (12 total runs), indicating command-line activity. At 14:41 UTC, Outlook was opened for the final time (1 run), suggesting a final email was sent. At 14:42 UTC, Windows Media Player (WMPLAYER.EXE) ran once, possibly to review a media file from the exfiltrated collection.
At 14:50 UTC, the Eraser 6.2.0.2962 installer executed. Eraser version 6.2.0.2962, previously downloaded to the Desktop's Download folder (Eraser 6.2.0.2962.exe with a Zone.Identifier alternate data stream confirming internet download), was installed alongside its .NET dependencies (ASPNET_REGIIS.EXE at 14:54 UTC, NGEN.EXE at 14:52 UTC, REGTLIBV12.EXE at 14:51 UTC).
At 14:57 UTC, VSSVC.EXE ran again (6 total runs), consistent with Volume Shadow Copy activity triggered by the installation or file operations.
At 14:58 UTC, CCleaner 5.04 (ccsetup504.exe, also Zone.Identifier downloaded) was executed via CCleaner64.exe, confirmed by LNK artifact access time 2015-03-25T14:58:35Z. CCleaner was used to wipe browser history, temporary files, and application cache — eliminating evidence of the suspect's research into anti-forensic tools, CD burning methods, and forensic investigation techniques.
At 15:13 UTC, Eraser.exe ran twice (2 prefetch runs), executing configured secure file deletion tasks against specified directories and files. The Eraser Task List configuration file (Task List.ersy) remains at inode 22321 on the PC.
At 15:21:40 UTC, a prefetch file GOOGLEDRIVESYNC.EXE-841A0D94.pf was created in the MFT — confirming that Google Drive Sync executed after the CCleaner and Eraser cleanup, meaning Google Drive may have uploaded a final batch of files to the cloud even as local evidence was being destroyed.
At 15:22 UTC, Internet Explorer ran (14 total runs). The last documented activity is a LNK access for Resignation_Letter_(Iaman_Informant).xps at 15:28:33 UTC — the suspect's final recorded action before departing.
Key Findings
Suspect Identification
The suspect is identified with high confidence as Iaman Informant (email: iaman.informant@nist.gov), a NIST employee. This identity was confirmed through: the Outlook OST path containing the email address, the resignation letter bearing the name "Iaman Informant" found on the informant's Desktop, USB drive volume labels "IAMAN $_@" and "IAMAN CD," and the local Windows account name "informant."
Confidential Project Data Exfiltrated
The suspect accessed and exfiltrated the following "secret project" documents from the NIST network file server (\10.11.11.128\secured_drive):
- [secret_project]_pricing_decision.xlsx — financial/pricing intelligence
- [secret_project]_design_concept — design documentation
- [secret_project]_final_meeting.pptx — meeting presentation
- [secret_project]_proposal.docx — project proposal
- winter_whether_advisory.zip and other files
Government Agency Documents
Bulk_extractor analysis of the removable media recovered embedded references to documents from multiple US government agencies: mmeyer@mail.hq.nasa.gov (NASA HQ), mmun@loc.gov (Library of Congress), th276a@nih.gov (NIH), and URLs referencing NASA's GSFC NODIS system, Department of Energy, and the White House. The RM2 and RM3 media also contained JPEG photographs taken with a Kodak Digital Science DC260 camera consistent with archival document digitization.
Multi-Vector Exfiltration
The suspect employed at least five exfiltration vectors simultaneously:
1. USB exFAT drive (RM1, "Authorized USB"): Accessed December 2014 – February 2015
2. USB FAT32 drive (RM2, "IAMAN $_@"): All files subsequently deleted, recovered as $OrphanFiles from multiple folders (design, PRICIN~1, TECHNI~1, progress, proposal) containing databases, archives, media, and diary text files
3. CD-R disc (RM3, "IAMAN CD"): Burned with government document fragments
4. Google Drive Sync: Installed (googledrivesync.exe downloaded with Zone.Identifier), actively syncing to Google Cloud, with all local sync logs and database files subsequently deleted
5. Apple iCloud: Installed (icloudsetup.exe downloaded; iCloud Control Panel 4.0.6.28 installer cache deleted from ProgramData/Apple)
Systematic Anti-Forensic Campaign
The suspect conducted a premeditated anti-forensic campaign demonstrating advance research into cover-up techniques. Browser search history reveals searches for "anti-forensic tools" (n=85), "ccleaner" (n=65), "external device and forensics" (n=65), "cd burning method" (n=64), "e-mail investigation" (n=88), and "DLP DRM" (n=90). Two dedicated data wiping tools were installed and used: CCleaner 5.04 (browser/temp file wiper) and Eraser 6.2.0.2962 (secure file overwriter). Both tools and their installer files were subsequently deleted. Google Drive sync logs, iCloud installer cache, Chrome browser history, and cloud shortcuts were all deliberately removed.
Impact Assessment
The breach affected confidential NIST project data including strategic design documents, pricing intelligence, meeting records, and proposals spanning a project designated internally as "the secret project." Additionally, documents from multiple federal agencies (NASA, NIH, Library of Congress, DOE) were exfiltrated, suggesting cross-agency research or reference materials held by NIST were also taken.
The exfiltration period spans at least December 2014 through March 25, 2015 — approximately four months. The use of Google Drive and potentially iCloud means data may have been uploaded to external cloud storage that is no longer accessible through local forensic examination. The full scope of cloud-uploaded data cannot be determined from the available evidence due to deleted sync databases.
Three user accounts were present on the PC (admin11, informant, temporary). No evidence was found of admin11 or temporary account involvement in the data theft. The "informant" account was the sole exfiltration actor.
Recommendations
Immediate Actions:
1. Preserve and subpoena Google account records for the suspect's Google account (associated with googledrivesync.exe) from Google LLC for data uploaded between December 2014 and March 25, 2015.
2. Preserve and subpoena Apple iCloud records associated with the iCloud account installed on this PC.
3. Preserve and subpoena Office 365 / Exchange Online email logs for iaman.informant@nist.gov for emails sent on March 25, 2015 at approximately 14:41 UTC.
4. Conduct network traffic log analysis for the PC's IP address against the internal server at 10.11.11.128 during the period December 2014 – March 2015.
5. Examine the Eraser Task List file at inode 22321 (Task List.ersy) using a forensic workstation with direct partition access to determine exactly which directories and files were targeted for secure deletion.
Remediation:
1. Revoke all NIST credentials and system access for iaman.informant@nist.gov immediately.
2. Audit access logs for the network share \\10.11.11.128\secured_drive\Secret Project Data for all users over the past 12 months.
3. Implement Data Loss Prevention (DLP) controls to block or log bulk copying to removable media.
4. Implement endpoint monitoring with USB device tracking and cloud sync application controls.
5. Review and restrict access to sensitive project repositories based on need-to-know principles.
Evidence Preservation:
The anti-forensic tools (CCleaner and Eraser) were successful in destroying some evidence. Recovered data from $OrphanFiles on RM2, bulk_extractor carving of prefetch and LNK data, and MFT record fragments provide strong evidentiary support despite the cleanup. The Eraser Task List.ersy and the Google Drive cloud_graph/dict_2.db (inode 75062) may contain additional evidentiary value and should be examined with specialist tooling capable of NTFS partition-offset icat extraction.
Conclusion
This investigation establishes with high confidence that Iaman Informant (iaman.informant@nist.gov), a NIST employee, conducted a premeditated, multi-month data exfiltration operation prior to their resignation. Beginning no later than December 2014 and culminating on March 25, 2015, the suspect systematically copied confidential project files — including design concepts, financial pricing data, meeting presentations, and proposals — from a protected NIST network file server to multiple personal removable media devices and cloud storage accounts. The suspect researched anti-forensic countermeasures, installed and used CCleaner and Eraser to destroy evidence, and deleted cloud synchronization databases to obscure the full extent of the exfiltration. The last recorded action on the PC was viewing the resignation letter in XPS format at 15:28:33 UTC on March 25, 2015.
Attack Timeline
Findings
The suspect is identified as "Iaman Informant," a user with a local account named "informant" on the PC. The resignation letter file "Resignation_Letter_(Iaman_Informant).docx" was found on the informant user's Desktop (inode 23554) and in Windows/Office Recent Items, with an active temp file "~$signation_Letter_(Iaman_Informant).docx" (deleted) indicating it was open during the incident. An XPS version was also present (inode 72008). The user profile at Users/informant contains NTUSER.DAT (inode 521), Outlook data, and full browser/cloud tool installations. Two user accounts exist on the PC: "admin11" (likely the primary employee) and "informant" — the latter is the exfiltrating actor.
Evidence Chain
The informant user accessed and staged multiple confidential "secret project" documents from the PC, as evidenced by LNK files in both Windows Recent and Office Recent folders:
- (secret_project)_pricing_decision.xlsx (Office Recent inode 4219; Windows Recent inode 4249)
- [secret_project]_design_concept (Office Recent inode 71947)
- [secret_project]_final_meeting.pptx (Office Recent inode 7508; Windows Recent inode 4166)
- [secret_project]_proposal (Windows Recent inode 70401; Office Recent inode 71235)
- secret.lnk (Windows Recent inode 70488)
- winter_whether_advisory.zip (Windows Recent inode 20180) — later found deleted on RM2 USB
The presence of LNK entries in both Office Recent and Windows Recent confirms actual file opens, not just filesystem navigation. The secret project covers design concepts, final meeting presentations, proposals, and pricing decisions — indicating highly sensitive business intelligence was targeted.
Evidence Chain
Evidence confirms at least four exfiltration vectors used by the informant:
-
USB exFAT Drive (RM1): 74.6 MB image; bulk_extractor found emails, URLs, EXIF data, and ZIP content including government document fragments.
-
USB FAT32 Drive (RM2): 243.2 MB image; fls recovered 13+ windows of deleted files including folders: design/ (winter_storm.amr, winter_whether_advisory.zip), PRICIN~1/ (my_favorite_cars.db, my_favorite_movies.7z, super_bowl.avi), progress/ (my_friends.svg, my_smartphone.png, new_year_calendar.one), proposal/ (a_gift_from_you.gif, landscape.png), TECHNI~1/ (diary_#1d.txt through diary_#3p.txt). All files deleted from USB after use.
-
CD-R (RM3): 90.2 MB ISO image; bulk_extractor found government document fragments with NASA GSFC URLs (nodis3.gsfc.nasa.gov, n=36), DOE (sc.doe.gov, n=16), Whitehouse.gov, PNAS.org, and email addresses mmeyer@mail.hq.nasa.gov, mmun@loc.gov, th276a@nih.gov.
-
Google Drive: googledrivesync.exe downloaded to informant's Downloads (inode 72145 with Zone.Identifier). Google Drive installed under Users/informant/AppData/Local/Google/Drive/ with sync_log.log, snapshot.db, sync_config.db all deleted post-use. Google Drive shortcut on Desktop (inode 75066) also deleted.
-
iCloud: icloudsetup.exe downloaded (inode 72096 with Zone.Identifier). iCloud Control Panel 4.0.6.28 installer cache found deleted from ProgramData/Apple/Installer Cache/. Apple Software Update present in informant AppData.
winter_whether_advisory.zip appears in both the PC (Windows Recent LNK) and RM2 USB ($OrphanFiles), directly linking the two.
Evidence Chain
Bulk_extractor analysis of the removable media confirms government agency documents were exfiltrated:
Email addresses embedded in documents on removable media:
- mmeyer@mail.hq.nasa.gov (NASA HQ) — found in RM2 and RM3 (inside a ZIP/Word document)
- mmun@loc.gov (Library of Congress) — found in RM2 and RM3
- th276a@nih.gov (National Institutes of Health) — found in RM3 CDR
URL patterns in RM3 CDR documents:
- nodis3.gsfc.nasa.gov (n=36) — NASA Goddard Space Flight Center NODIS system
- www.sc.doe.gov (n=16) — Department of Energy Science
- www.whitehouse.gov — White House
- www.pnas.org — Proceedings of the National Academy of Sciences
- digitalcorpora.org (n=63)
The presence of multiple government agency email addresses embedded in Office documents stored on the removable media confirms that confidential government or contractor documents were taken off-site. RFC822 artifact analysis found library-catalog style records on RM3 ("Subject: Portraits of three Indians (half-length)") suggesting Library of Congress catalog records.
Evidence Chain
LNK file artifacts recovered from the PC via bulk_extractor winlnk scanner reveal that the informant accessed a network file share containing secret project data:
Network path: \10.11.11.128\secured_drive\Secret Project Data\final
Mapped drive letter: V:
Access time: 2015-03-22T14:52:21Z
This establishes that the secret project files resided on an internal network file server at IP 10.11.11.128, mounted as drive V: under the name 'secured_drive'. The informant browsed to the 'Secret Project Data\final' subdirectory, consistent with accessing finalized project documents before exfiltrating them to removable media. The LNK creation/modification/access times all show 2015-03-22T14:52:21Z, indicating this was the access event.
Evidence Chain
The suspect is definitively identified as 'Iaman Informant' (iaman.informant@nist.gov), a NIST (National Institute of Standards and Technology) employee:
- Outlook OST file path recovered from bulk.email: 'Outlook\iaman.informant@nist.gov.ost' — confirms the informant's corporate email address at NIST
- Additional NIST email addresses in bulk.domain: '6f-b1df9935415b@nist.gov' (ExchangeLabs format) with /o=ExchangeLabs — confirms NIST uses Microsoft Exchange Online (Office 365)
- Network file server 10.11.11.128 ('secured_drive') referenced alongside nist.gov in bulk.domain
- Username on PC: 'informant' with NTUSER.DAT at inode 521
- Resignation letter on Desktop: 'Resignation_Letter_(Iaman_Informant).docx'
- USB drives with labels consistent with the name: 'IAMAN $_@' (RM2 FAT32) and 'IAMAN CD' (RM3 CDR)
This is a NIST employee who used their work PC to stage and exfiltrate confidential project data before submitting their resignation.
Evidence Chain
LNK artifacts identify three removable media devices used for exfiltration, all labeled with the suspect's alias:
- RM1 ('Authorized USB', E:\RM#1) — exFAT USB drive:
- Accessed 2015-02-15T21:52:12Z: E:\RM#1\Secret Project Data\proposal\
- Accessed 2015-02-15T21:52:20Z: E:\RM#1\Secret Project Data\proposal[secret_project]_proposal.docx (file wtime: 2014-12-19T19:53:46Z)
-
Accessed 2015-02-15T21:52:08Z: E:\RM#1\Secret Project Data\design\
-
RM2 ('IAMAN $_@', E:) — FAT32 USB drive:
- Volume label confirmed in fls: 'IAMAN $_@ (Volume Label Entry)'
- Accessed 2015-03-24T04:00:00Z: E:\Secret Project Data\design\winter_whether_advisory.zip (file wtime: 2014-12-16T16:10:26Z)
- Multiple deleted folders recovered: design, PRICIN~1, progress, proposal, TECHNI~1
-
All contents deleted after use
-
RM3 ('IAMAN CD', D:) — CD-R disc:
- Volume label: 'IAMAN CD'
- Accessed 2015-03-24T20:40:55Z: D:\de\winter_whether_advisory.zip (file wtime: 2014-12-16T16:10:26Z)
- Contains government document fragments (NASA, NIH, Library of Congress)
Earliest exfiltration: 2015-02-15 (RM1 USB). Last exfiltration: 2015-03-24 (RM2/RM3). Anti-forensic cleanup: 2015-03-25.
Evidence Chain
Prefetch artifacts and winlnk cross-correlation establish a detailed execution timeline:
2015-02-15 (~21:52 UTC):
- First USB exfiltration: Accessed E:\RM#1\Secret Project Data\proposal[secret_project]_proposal.docx on 'Authorized USB' (RM1)
- Files with wtime as early as 2014-12-19 — data was prepared months earlier
2015-03-22 (primary access day):
- 14:34:31 UTC — 'informant' user DIRECTORY CREATED in MFT (account newly created)
- 14:34:55 UTC — Informant's Desktop browsed
- 14:52:21 UTC — Network share \10.11.11.128\secured_drive\Secret Project Data browsed (drive V:)
- 14:52:21 UTC — (secret_project)_pricing_decision.xlsx accessed from network share
- 15:03:23 UTC — Outlook opened (iaman.informant@nist.gov)
- 15:11:51 UTC — Google Chrome opened (multiple instances, browsing)
- 15:54:04 UTC — admin11 account Quick Launch accessed
- 15:56:07 UTC — 'temporary' user account Quick Launch accessed
2015-03-24:
- 14:05:12 UTC — Internet Explorer ran (12 runs)
- 15:21:38 UTC — VSSVC.EXE (Volume Shadow Copy) ran (4 runs)
- 18:31:55 UTC — STIKYNOT.EXE (Sticky Notes) ran (2 runs) - notes during resignation letter writing
- 18:48:40 UTC — Resignation Letter accessed in Word (creation)
- 18:59:30 UTC — Resignation Letter opened/edited in Word
- 19:09:51 UTC — WINWORD.EXE last ran (2 total runs)
- 20:40:55 UTC — 'IAMAN $_@' USB accessed (winter_whether_advisory.zip on E:)
- 20:57:00 UTC — 'IAMAN CD' (RM3 CDR) accessed: D:\Koala.jpg
- 20:58:06 UTC — Browsing root of 'IAMAN CD' disc
- 21:02:47 UTC — DEVICEDISPLAYOBJECTPROVIDER.EXE ran (USB device display)
2015-03-25 (anti-forensic cleanup day):
- 10:18:15 UTC — CLRGC.EXE (CLR GC, possibly Google Drive sync)
- 13:07:49 UTC — SVCHOST.EXE ran
- 13:24:10 UTC — SYSTEM registry hive accessed (MFT)
- 14:20:09 UTC — TASKENG.EXE (Task Scheduler, 23 runs)
- 14:31:53 UTC — CONHOST.EXE ran (12 runs) — command-line session
- 14:41:03 UTC — OUTLOOK.EXE ran (1 run) — final email sent
- 14:41:13 UTC — IE History folder MSHist012015032520150326 created (browsing)
- 14:42:47 UTC — WMPLAYER.EXE ran (1 run) — played media file
- 14:47:29 UTC — Ad tracking GIF downloaded (web browsing)
- 14:50:14 UTC — Eraser 6.2.0.2962.EXE installer ran (installation)
- 14:50:17 UTC — SETUP.EXE ran (Eraser installer)
- 14:50:53 UTC — TMP5B99.TMP.EXE ran (installer temp)
- 14:51:29 UTC — UIAutomationClient.dll created (Eraser .NET dependency)
- 14:52:57 UTC — NGEN.EXE ran (.NET compilation for Eraser)
- 14:54:21 UTC — ASPNET_REGIIS.EXE ran (ASP.NET registration)
- 14:57:18 UTC — VSSVC.EXE ran (6 runs) — Volume Shadow Copy activity
- 14:58:35 UTC — CCleaner64.exe LNK accessed (CCleaner ran)
- 15:13:30 UTC — ERASER.EXE ran (2 runs) — secure file deletion
- 15:15:54 UTC — ccc0fa1b9f86f7b3.customDestinations-ms accessed (Jump List for an application)
- 15:21:31 UTC — menu_sync_anim_2x.gif (web browsing after cleanup)
- 15:21:40 UTC — GOOGLEDRIVESYNC.EXE-841A0D94.pf CREATED — Google Drive ran AFTER cleanup!
- 15:22:07 UTC — IEXPLORE.EXE ran (14 runs)
- 15:28:33 UTC — Resignation_Letter_(Iaman_Informant).xps LNK accessed — LAST DOCUMENTED ACTION
Evidence Chain
A prefetch artifact for GoogleDriveSync was discovered created AFTER the CCleaner and Eraser cleanup activities:
- MFT record: 'GOOGLEDRIVESYNC.EXE-841A0D94.pf' created at 2015-03-25T15:21:40Z
- This is the Windows Prefetch file for Google Drive Sync, meaning Google Drive Sync was EXECUTED at 15:21:40 on March 25
- CCleaner ran at 14:58:35 and Eraser ran at 15:13:30
- Google Drive sync ran at 15:21:40 — TEN MINUTES AFTER Eraser was used to wipe files
This means that either:
1. Google Drive continued auto-syncing files from the 'My Drive' folder AFTER the cleanup, potentially uploading additional data to Google Cloud
2. Or the informant manually ran Google Drive Sync as a final exfiltration step after clearing local traces
The informant account at Users/informant/AppData/Local/Google/Drive/ had sync_log.log, snapshot.db, and sync_config.db deleted — but the sync CONTINUED before the final logoff. The Google Drive shortcut was also deleted from the Desktop (inode 75066).
Data exfiltrated via Google Drive remains unrecovered as the sync database files were deleted.
Evidence Chain
The informant deliberately deleted cloud synchronization artifacts after exfiltration, indicating awareness of forensic investigation:
Google Drive:
- sync_log.log (inode 75035): listed as both present and deleted (r/- * 0) — overwritten
- snapshot.db (inode 75039): deleted (-/r )
- sync_config.db (inode 75040): deleted (-/r )
- sync_config.db-wal (inode 73727): deleted
- sync_config.db-shm (inode 73728): deleted
- snapshot.db-shm (inode 73726): deleted
- Google Drive.lnk on Desktop (inode 75066): deleted (-/r *)
- cloud_graph/dict_2.db-wal (inode 73730): deleted
- cloud_graph/dict_2.db-shm (inode 73731): deleted
iCloud:
- iCloud Control Panel 4.0.6.28 installer cache: deleted from ProgramData/Apple/Installer Cache/
- Chrome History for informant: History database absent; only History-journal remains (inode 62907)
All RM2 USB files were also deleted from the FAT32 drive after copying, recovered only as $OrphanFiles.
This systematic deletion of sync logs, configuration databases, browser history, and cloud shortcuts demonstrates planned anti-forensic activity to conceal the scope of exfiltration.
Evidence Chain
Bulk_extractor URL search histogram extracted from the PC image reveals the informant's premeditated anti-forensic research. The top search queries found in browser history (counts indicate frequency across sessions/pages):
- 'file sharing and tethering' (n=491) — researched exfiltration methods
- 'DLP DRM' (n=90) — researched Data Loss Prevention and Digital Rights Management (evasion)
- 'e-mail investigation' (n=88) — researched email forensics
- 'anti-forensic tools' (n=85) — directly researched tools to cover tracks
- 'Forensic Email Investigation' (n=78) — researched email forensics investigation methods
- 'ccleaner' (n=65) — researched the specific wiping tool later installed
- 'external device and forensics' (n=65) — researched USB/external device forensics
- 'cd burning method' (n=64) — researched CD-R burning (method used with RM3)
This search pattern demonstrates premeditation, research into cover-up techniques, and active evasion of DLP controls. The informant deliberately studied how digital forensics investigations work before committing the theft.
Evidence Chain
Two data-wiping anti-forensic tools were installed on the PC and later uninstalled/deleted, indicating a deliberate attempt to erase evidence of the data theft:
-
CCleaner: Installed at Program Files/CCleaner/ (directories and files all deleted: -/d * 75246, -/r * 75248 CCleaner.exe, -/r * 75250 CCleaner64.exe). Desktop shortcut also deleted: Users/Public/Desktop/CCleaner.lnk (-/r * 75306). CCleaner web page cached in informant's IE Temporary Internet Files. LNK file for CCleaner64.exe shows last access 2015-03-25T14:58:35Z.
-
Eraser: Desktop shortcut deleted: Users/Public/Desktop/Eraser.lnk (-/r * 75235). Eraser is a secure file overwriting tool that prevents recovery.
-
CONHOST.EXE prefetch: atime 2015-03-25T14:31:53Z, 12 runs — indicates command-line tool use on 2015-03-25.
-
Browser history confirms informant searched: 'anti-forensic tools' (n=85), 'ccleaner' (n=65), 'external device and forensics' (n=65). CCleaner cache pages stored in informant's IE Temporary Internet Files (inode 75119, 71565, 75162).
The CCleaner LNK timestamp of 2015-03-25T14:58:35Z establishes that anti-forensic tool usage occurred on March 25, 2015.
Evidence Chain
Outlook.exe ran on the morning of the anti-forensic cleanup day:
- OUTLOOK.EXE prefetch: atime 2015-03-25T14:41:03Z, 1 run — Outlook opened just 17 minutes before starting the Eraser installation
- LNK for OUTLOOK.EXE at 2015-03-22T15:03:23Z — also opened on the main file access day
- Outlook profile: iaman.informant@nist.gov (Office 365 ExchangeLabs)
- Outlook.srs file at Users/informant/AppData/Roaming/Microsoft/Outlook/Outlook.srs (inode 62951) confirms active Outlook profile
- NIST uses Microsoft Exchange Online (Office 365) as confirmed by /o=ExchangeLabs format in email artifacts
The timing suggests the informant may have emailed documents to a personal address before deleting evidence. This cannot be confirmed without email content (PST/OST file) but the single run of Outlook immediately before starting the wiping process is highly suspicious. No PST/OST files were found in the fls listing (they may have been encrypted or stored elsewhere).
Evidence Chain
EXIF metadata extracted from JPEG files on all three removable media shows images taken with an Eastman Kodak DIGITAL SCIENCE DC260 (V01.00) camera:
- RM3 CDR: Kodak DC260 EXIF at offset 1,310,146
- RM2 FAT32: Kodak DC260 EXIF at offsets 4,912,578 and 27,555,388
- RM1 exFAT: Kodak DC260 EXIF at offset 1,093,257; Adobe Photoshop CS processed image
The Kodak DC260 is a late 1990s/early 2000s digital camera commonly used for document digitization and archival photography. Combined with RFC822 catalog records found on RM3 ('Subject: Portraits of three Indians (half-length)') consistent with Library of Congress catalog entries, these images likely represent digitized/photographed government documents and archival records.
One RM2 image has SHA1 hash: aab7ebb56ec75ae3da1534c300ac65637f96b9a9 (Adobe Photoshop CS processed).
Evidence Chain
These hypotheses were explicitly tested and no supporting evidence was found.
-
No Evidence of a Second Independent Attack Narrative
Phase 3.5 alternative narrative discovery found no evidence of a separate incident unrelated to the primary narrative: 1. admin11 account: No LNK files, Recent items, or file access evidence related to the secret project. Desktop and Documents folders contain only desktop.ini. No anti-forensic...
-
No Malware or Remote Access Tools Found
YARA signature scanning and steganography detection could not be performed on the disk images due to EWF mount failures preventing filesystem extraction. However, keyword searches across all bulk_extractor carving output (21 feature sources from PC, 6-7 from each removable medium) found no...
MITRE ATT&CK Coverage
Indicators of Compromise
| Type | Value | Context | Actions |
|---|---|---|---|
| External IP | 4.0.6.28 |
Multi-Vector Exfiltration — USB Drives, CD-R, Google Drive, and iCloud | VT |
| Internal IP | 10.11.11.128 |
Network File Server Access — \\10.11.11.128\secured_drive\Secret Project Data | VT |
| Type | Value | Context | Actions |
|---|---|---|---|
| Path | /System32/ |
[NEGATIVE] No Malware or Remote Access Tools Found |
| Type | Value | Context | Actions |
|---|---|---|---|
mmeyer@mail.hq.nasa.gov |
Multi-Vector Exfiltration — USB Drives, CD-R, Google Drive, and iCloud | ||
mmun@loc.gov |
Multi-Vector Exfiltration — USB Drives, CD-R, Google Drive, and iCloud | ||
th276a@nih.gov |
Government Agency Documents Exfiltrated — NASA, NIH, Library of Congress, DOE | ||
iaman.informant@nist.gov |
Suspect Fully Identified — iaman.informant@nist.gov, NIST Employee | ||
6f-b1df9935415b@nist.gov |
Suspect Fully Identified — iaman.informant@nist.gov, NIST Employee | ||
eric_p._lauer@omb.eop.gov |
[NEGATIVE] No Evidence of a Second Independent Attack Narrative | ||
scarter@gmail.com |
[NEGATIVE] No Evidence of a Second Independent Attack Narrative |
Evidence Browser
Evidence Sources
| Source Name | Extractor | Lines | Hash | Referenced By |
|---|---|---|---|---|
| tsk.partitions | sleuthkit | 8 | sha256:32ea60ffc... |
— |
| tsk.partitions | sleuthkit | 9 | sha256:d78c079fd... |
— |
| tsk.partitions | sleuthkit | 10 | sha256:bb36f7a96... |
— |
| tsk.filelist | sleuthkit | 51 | sha256:f0793bf37... |
10 findings |
| tsk.filelist | sleuthkit | 104709 | sha256:bd2811168... |
10 findings |
| tsk.fsstat | sleuthkit | 0 | sha256:empty... |
— |
| tsk.fsstat | sleuthkit | 0 | sha256:empty... |
— |
| tsk.fsstat | sleuthkit | 0 | sha256:empty... |
— |
| tsk.fsstat | sleuthkit | 0 | sha256:empty... |
— |
| bulk.domain | bulk_extractor | 7295 | sha256:e7c2c04ef... |
2 findings |
| bulk.email | bulk_extractor | 22 | sha256:8ddb0a922... |
5 findings |
| bulk.exif | bulk_extractor | 21 | sha256:09098ee14... |
1 finding |
| bulk.rfc822 | bulk_extractor | 41 | sha256:7b1ed102d... |
1 finding |
| bulk.url | bulk_extractor | 7204 | sha256:07301b859... |
— |
| bulk.url_services | bulk_extractor | 60 | sha256:08e097747... |
2 findings |
| bulk.zip | bulk_extractor | 5221 | sha256:186ddc8c3... |
— |
| bulk.domain | bulk_extractor | 7295 | sha256:f9a5b6f94... |
2 findings |
| bulk.domain | bulk_extractor | 5205 | sha256:3ddc590bf... |
2 findings |
| bulk.email | bulk_extractor | 26 | sha256:af2bcaad1... |
5 findings |
| bulk.email | bulk_extractor | 14 | sha256:8d657aa20... |
5 findings |
| bulk.exif | bulk_extractor | 27 | sha256:dbb0e2cf2... |
1 finding |
| bulk.exif | bulk_extractor | 20 | sha256:1ef0ad99e... |
1 finding |
| bulk.rfc822 | bulk_extractor | 41 | sha256:6d4d26d34... |
1 finding |
| bulk.url | bulk_extractor | 5226 | sha256:032b17e76... |
— |
| bulk.url | bulk_extractor | 7192 | sha256:39941b19c... |
— |
| bulk.url_services | bulk_extractor | 25 | sha256:6c7817daf... |
2 findings |
| bulk.zip | bulk_extractor | 3851 | sha256:60e2a257e... |
— |
| bulk.url_services | bulk_extractor | 58 | sha256:4218ed27f... |
2 findings |
| bulk.zip | bulk_extractor | 5221 | sha256:111ad2764... |
— |
| bulk.domain | bulk_extractor | 403461 | sha256:fd793a9e6... |
2 findings |
| bulk.email | bulk_extractor | 6553 | sha256:43ee17690... |
5 findings |
| bulk.ether | bulk_extractor | 6 | sha256:f683c999d... |
— |
| bulk.evtx_carved | bulk_extractor | 494 | sha256:aca9cc99d... |
— |
| bulk.exif | bulk_extractor | 794 | sha256:ab6dbd7a4... |
1 finding |
| bulk.ip | bulk_extractor | 29 | sha256:2fd20c26d... |
— |
| bulk.jpeg | bulk_extractor | 9 | sha256:b68da96b5... |
— |
| bulk.ntfsmft_carved | bulk_extractor | 338 | sha256:0810b56eb... |
— |
| bulk.ntfsusn_carved | bulk_extractor | 66223 | sha256:ae278b9e8... |
— |
| bulk.packets | bulk_extractor | 166 | sha256:3bb3f17b6... |
— |
| bulk.rfc822 | bulk_extractor | 7326 | sha256:43152175b... |
1 finding |
| bulk.sqlite_carved | bulk_extractor | 95 | sha256:f886219ce... |
— |
| bulk.tcp | bulk_extractor | 15 | sha256:2659e25b3... |
— |
| bulk.url | bulk_extractor | 458526 | sha256:54bb39ee0... |
— |
| bulk.url_facebook-address | bulk_extractor | 19 | sha256:4cdbd4c41... |
— |
| bulk.url_searches | bulk_extractor | 155 | sha256:9a2653153... |
2 findings |
| bulk.url_services | bulk_extractor | 3683 | sha256:56ce9dac0... |
2 findings |
| bulk.windirs | bulk_extractor | 84104 | sha256:c9c559055... |
4 findings |
| bulk.winlnk | bulk_extractor | 466 | sha256:be8c34223... |
4 findings |
| bulk.winprefetch | bulk_extractor | 155 | sha256:669008868... |
4 findings |
| bulk.zip | bulk_extractor | 22327 | sha256:32ae038aa... |
— |
Investigation Performance
| Input Tokens (est.) | 5,688 |
| Output Tokens (est.) | 25,472 |
| Total Tokens (est.) | 31,160 |
| Tool | Duration | Params |
|---|---|---|
| run_bulk_extractor | 939.8s | |
| run_bulk_extractor | 54.0s | |
| run_bulk_extractor | 52.1s | |
| run_registry_parser | 21.7s | |
| run_prefetch_parser | 20.2s | |
| run_fls | 15.3s | |
| submit_finding | 11.7s | |
| run_bulk_extractor | 10.7s | |
| run_shimcache_parser | 6.9s | |
| submit_finding | 6.5s |
Audit Trail
| ID | Tool | Duration | Timestamp | Actions |
|---|---|---|---|---|
| tc_38160f8b | run_mmls | 0ms | 2026-04-20T18:56:02 | |
| tc_78921ac0 | run_mmls | 0ms | 2026-04-20T18:56:02 | |
| tc_85157059 | run_mmls | 0ms | 2026-04-20T18:56:02 | |
| tc_97ef7145 | run_mmls | 0ms | 2026-04-20T18:56:02 | |
| tc_e38581ab | list_directory | 16ms | 2026-04-20T18:56:18 | |
| tc_f3756cae | run_mmls | 0ms | 2026-04-20T18:56:36 | |
| tc_7c4c8993 | run_mmls | 51ms | 2026-04-20T18:56:36 | |
| tc_c64b79f8 | run_mmls | 74ms | 2026-04-20T18:56:36 | |
| tc_d0acb591 | run_mmls | 203ms | 2026-04-20T18:56:36 | |
| tc_39198dd0 | get_raw_output | 9ms | 2026-04-20T18:56:58 | |
| tc_b3f66a01 | start_extraction_batch | 10ms | 2026-04-20T18:57:31 | |
| tc_1d7b3547 | run_bulk_extractor | 0ms | 2026-04-20T18:57:31 | |
| tc_7ea19317 | run_bulk_extractor | 0ms | 2026-04-20T18:57:31 | |
| tc_90be509e | run_bulk_extractor | 0ms | 2026-04-20T18:57:31 | |
| tc_50540b66 | run_bulk_extractor | 0ms | 2026-04-20T18:57:31 | |
| tc_55c42090 | run_fls | 0ms | 2026-04-20T18:57:31 | |
| tc_ae9c5f09 | run_fls | 0ms | 2026-04-20T18:57:31 | |
| tc_ed9992e4 | run_registry_parser | 35ms | 2026-04-20T18:57:31 | |
| tc_a3b32d00 | run_fls | 2187ms | 2026-04-20T18:57:33 | |
| tc_45c3ab55 | run_hayabusa | 1ms | 2026-04-20T18:57:41 | |
| tc_eab15fab | run_fls | 15257ms | 2026-04-20T18:57:46 | |
| tc_d3a23b40 | run_fsstat | 44ms | 2026-04-20T18:58:01 | |
| tc_fa4e7d47 | run_fsstat | 76ms | 2026-04-20T18:58:01 | |
| tc_ea9e8bfa | run_fsstat | 91ms | 2026-04-20T18:58:01 | |
| tc_832d0ec7 | run_fsstat | 112ms | 2026-04-20T18:58:01 | |
| tc_973f4f90 | check_extraction_status | 0ms | 2026-04-20T18:58:16 | |
| tc_4f213610 | get_completed_results | 0ms | 2026-04-20T18:58:28 | |
| tc_21fd0a2f | run_evtx_parser | 0ms | 2026-04-20T18:59:08 | |
| tc_5a22777e | list_files | 881ms | 2026-04-20T18:59:42 | |
| tc_9c4d6c45 | list_files | 1233ms | 2026-04-20T18:59:43 | |
| tc_7136172c | list_files | 1255ms | 2026-04-20T18:59:43 | |
| tc_c6965fb8 | list_files | 1265ms | 2026-04-20T18:59:43 | |
| tc_971c9869 | start_extraction_batch | 2ms | 2026-04-20T19:00:11 | |
| tc_72c47006 | run_fls | 0ms | 2026-04-20T19:00:11 | |
| tc_7594ea28 | run_fls | 0ms | 2026-04-20T19:00:11 | |
| tc_034e0e09 | run_evtx_parser | 0ms | 2026-04-20T19:00:21 | |
| tc_c4e44d96 | run_bulk_extractor | 10704ms | 2026-04-20T19:00:21 | |
| tc_75896e5c | list_files | 1209ms | 2026-04-20T19:00:26 | |
| tc_c349d180 | run_prefetch_parser | 20200ms | 2026-04-20T19:00:31 | |
| tc_cf8709fe | run_registry_parser | 21670ms | 2026-04-20T19:00:32 | |
| tc_9c9004e4 | run_bulk_extractor | 52136ms | 2026-04-20T19:01:03 | |
| tc_b61a5289 | run_bulk_extractor | 53993ms | 2026-04-20T19:01:05 | |
| tc_9c335f0c | list_files | 1037ms | 2026-04-20T19:01:21 | |
| tc_611854fa | list_files | 681ms | 2026-04-20T19:03:36 | |
| tc_d7b18e68 | list_files | 701ms | 2026-04-20T19:03:36 | |
| tc_44149638 | search | 46ms | 2026-04-20T19:04:00 | |
| tc_afe5fd02 | search | 24ms | 2026-04-20T19:04:15 | |
| tc_5fe0d754 | search | 34ms | 2026-04-20T19:05:05 | |
| tc_b4674900 | list_files | 402ms | 2026-04-20T19:06:46 | |
| tc_b6634b47 | check_extraction_status | 0ms | 2026-04-20T19:07:30 | |
| tc_c0a21b6b | extract_file_by_inode | 232ms | 2026-04-20T19:07:30 | |
| tc_cc6f2011 | extract_file_by_inode | 237ms | 2026-04-20T19:07:30 | |
| tc_ab173556 | extract_file_by_inode | 237ms | 2026-04-20T19:07:30 | |
| tc_eda2769f | extract_file_by_inode | 238ms | 2026-04-20T19:07:30 | |
| tc_fa73fa0a | extract_file_by_inode | 237ms | 2026-04-20T19:07:30 | |
| tc_9d77fb9a | extract_file_by_inode | 241ms | 2026-04-20T19:07:30 | |
| tc_545fd8de | get_completed_results | 0ms | 2026-04-20T19:07:41 | |
| tc_126b5b65 | extract_file_by_inode | 15ms | 2026-04-20T19:07:41 | |
| tc_3a210c3a | extract_file_by_inode | 16ms | 2026-04-20T19:07:41 | |
| tc_d41466b7 | extract_file_by_inode | 15ms | 2026-04-20T19:07:41 | |
| tc_abe8f2cc | search | 23ms | 2026-04-20T19:08:14 | |
| tc_9f50f50e | search | 25ms | 2026-04-20T19:08:14 | |
| tc_9d909bd7 | search | 27ms | 2026-04-20T19:08:14 | |
| tc_cb1d1de0 | search | 33ms | 2026-04-20T19:08:14 | |
| tc_d2b758db | search | 19ms | 2026-04-20T19:08:37 | |
| tc_e259a434 | get_raw_output | 147ms | 2026-04-20T19:08:37 | |
| tc_b03da25f | get_raw_output | 145ms | 2026-04-20T19:08:37 | |
| tc_c53685ed | get_raw_output | 145ms | 2026-04-20T19:08:37 | |
| tc_53a2ddfe | search | 7ms | 2026-04-20T19:08:59 | |
| tc_f4a20f57 | search | 82ms | 2026-04-20T19:08:59 | |
| tc_c37fb54f | get_raw_output | 217ms | 2026-04-20T19:08:59 | |
| tc_f2c6c224 | search | 431ms | 2026-04-20T19:09:00 | |
| tc_b123e48d | search | 871ms | 2026-04-20T19:09:00 | |
| tc_2b7fedf8 | search | 1253ms | 2026-04-20T19:09:00 | |
| tc_775e08e2 | extract_file_by_inode | 31ms | 2026-04-20T19:09:31 | |
| tc_067a7b69 | extract_file_by_inode | 31ms | 2026-04-20T19:09:31 | |
| tc_2f905212 | search | 47ms | 2026-04-20T19:09:31 | |
| tc_6b60557f | extract_file_by_inode | 50ms | 2026-04-20T19:09:31 | |
| tc_6ed7ce93 | search | 69ms | 2026-04-20T19:09:31 | |
| tc_d25382f9 | search | 433ms | 2026-04-20T19:09:31 | |
| tc_3cad4dfa | parse_lnk_files | 6ms | 2026-04-20T19:10:12 | |
| tc_99199ef1 | parse_shellbags | 7ms | 2026-04-20T19:10:12 | |
| tc_cf295688 | parse_jump_lists | 7ms | 2026-04-20T19:10:12 | |
| tc_2cb6844c | search | 11ms | 2026-04-20T19:10:12 | |
| tc_2d9535eb | parse_browser_history | 1762ms | 2026-04-20T19:10:13 | |
| tc_fd0d32a0 | check_extraction_status | 0ms | 2026-04-20T19:10:39 | |
| tc_c31a9939 | search | 56ms | 2026-04-20T19:10:39 | |
| tc_125c5b41 | search | 57ms | 2026-04-20T19:10:39 | |
| tc_38e0c9b3 | search | 78ms | 2026-04-20T19:10:39 | |
| tc_14783c8d | search | 386ms | 2026-04-20T19:10:39 | |
| tc_f230298d | search | 6ms | 2026-04-20T19:11:02 | |
| tc_0c6a684b | search | 6ms | 2026-04-20T19:11:02 | |
| tc_407d4136 | search | 7ms | 2026-04-20T19:11:02 | |
| tc_17110d91 | search | 31ms | 2026-04-20T19:11:22 | |
| tc_82fcf135 | get_raw_output | 38ms | 2026-04-20T19:11:22 | |
| tc_b5b59dd2 | get_raw_output | 81ms | 2026-04-20T19:11:22 | |
| tc_aa92ddf6 | search | 415ms | 2026-04-20T19:11:22 | |
| tc_b7084ba4 | get_raw_output | 6ms | 2026-04-20T19:11:37 | |
| tc_96b20860 | search | 8ms | 2026-04-20T19:11:37 | |
| tc_327a69e4 | search | 9ms | 2026-04-20T19:11:37 | |
| tc_a691287b | start_extraction_batch | 2ms | 2026-04-20T19:12:33 | |
| tc_c9d229db | run_mactime | 0ms | 2026-04-20T19:12:33 | |
| tc_ba25cec3 | run_mactime | 0ms | 2026-04-20T19:12:33 | |
| tc_b503a7a8 | run_mactime | 0ms | 2026-04-20T19:12:33 | |
| tc_e10d9716 | run_mactime | 0ms | 2026-04-20T19:12:33 | |
| tc_0a93b6e1 | parse_srum | 9ms | 2026-04-20T19:12:47 | |
| tc_34016ec4 | search | 16ms | 2026-04-20T19:12:47 | |
| tc_eb168ac8 | search | 17ms | 2026-04-20T19:12:47 | |
| tc_de19c538 | search | 16ms | 2026-04-20T19:12:47 | |
| tc_100898cb | get_raw_output | 45ms | 2026-04-20T19:12:47 | |
| tc_1ad122a1 | search | 55ms | 2026-04-20T19:13:26 | |
| tc_4c463a6d | search | 793ms | 2026-04-20T19:13:27 | |
| tc_3f3c1e46 | lookup_attack_technique | 811ms | 2026-04-20T19:13:27 | |
| tc_c9c8991f | lookup_attack_technique | 812ms | 2026-04-20T19:13:27 | |
| tc_4b8b23f4 | lookup_attack_technique | 812ms | 2026-04-20T19:13:27 | |
| tc_205d3450 | lookup_attack_technique | 813ms | 2026-04-20T19:13:27 | |
| tc_60b2b72f | submit_finding | 5708ms | 2026-04-20T19:14:10 | |
| tc_cfbca01b | submit_finding | 6390ms | 2026-04-20T19:14:28 | |
| tc_2ab05773 | submit_finding | 11663ms | 2026-04-20T19:15:01 | |
| tc_a03a8b57 | submit_finding | 1166ms | 2026-04-20T19:15:14 | |
| tc_3b99d137 | submit_finding | 6493ms | 2026-04-20T19:15:33 | |
| tc_50769738 | run_bulk_extractor | 939839ms | 2026-04-20T19:15:51 | |
| tc_b99a87a6 | check_extraction_status | 0ms | 2026-04-20T19:15:52 | |
| tc_16f3a886 | check_extraction_status | 0ms | 2026-04-20T19:15:52 | |
| tc_f0a632a4 | get_raw_output | 365ms | 2026-04-20T19:15:52 | |
| tc_e0894a43 | search | 434ms | 2026-04-20T19:15:52 | |
| tc_abc8f64d | search | 18ms | 2026-04-20T19:15:57 | |
| tc_b0c71fbf | get_completed_results | 0ms | 2026-04-20T19:16:10 | |
| tc_b1a44d36 | get_completed_results | 0ms | 2026-04-20T19:16:10 | |
| tc_4c239efc | search | 39ms | 2026-04-20T19:16:28 | |
| tc_3d6b65f2 | search | 68ms | 2026-04-20T19:16:28 | |
| tc_69f68032 | get_raw_output | 446ms | 2026-04-20T19:16:28 | |
| tc_375813fc | get_raw_output | 2219ms | 2026-04-20T19:16:30 | |
| tc_5c3ab093 | get_raw_output | 2343ms | 2026-04-20T19:16:30 | |
| tc_0eae9ba5 | search | 57ms | 2026-04-20T19:16:45 | |
| tc_13122d8c | search | 72ms | 2026-04-20T19:16:45 | |
| tc_336fc8d0 | get_raw_output | 309ms | 2026-04-20T19:16:45 | |
| tc_f03edfac | get_raw_output | 1308ms | 2026-04-20T19:16:46 | |
| tc_da64ef61 | get_raw_output | 1330ms | 2026-04-20T19:16:46 | |
| tc_9346dcc5 | search | 140ms | 2026-04-20T19:17:09 | |
| tc_4b208413 | search | 482ms | 2026-04-20T19:17:09 | |
| tc_9197200d | search | 865ms | 2026-04-20T19:17:09 | |
| tc_146737fc | get_raw_output | 1701ms | 2026-04-20T19:17:10 | |
| tc_52b0eaa6 | get_raw_output | 1703ms | 2026-04-20T19:17:10 | |
| tc_e1f832c7 | run_hayabusa | 2ms | 2026-04-20T19:17:57 | |
| tc_5623612c | submit_finding | 37ms | 2026-04-20T19:17:57 | |
| tc_0348f67d | search | 37ms | 2026-04-20T19:17:57 | |
| tc_651e8b30 | submit_finding | 45ms | 2026-04-20T19:17:57 | |
| tc_a1b9ec31 | search | 81ms | 2026-04-20T19:17:57 | |
| tc_1b4a7b4b | search | 27ms | 2026-04-20T19:18:24 | |
| tc_3a27764f | search | 35ms | 2026-04-20T19:18:24 | |
| tc_d85575da | search | 35ms | 2026-04-20T19:18:24 | |
| tc_a0c6df50 | search | 110ms | 2026-04-20T19:18:24 | |
| tc_0c45f701 | get_raw_output | 160ms | 2026-04-20T19:18:24 | |
| tc_3e538770 | search | 158ms | 2026-04-20T19:18:44 | |
| tc_4fd9f655 | search | 415ms | 2026-04-20T19:18:44 | |
| tc_b818815f | search | 422ms | 2026-04-20T19:18:44 | |
| tc_ddc75344 | search | 966ms | 2026-04-20T19:18:44 | |
| tc_dc997b7c | search | 43ms | 2026-04-20T19:19:06 | |
| tc_c2285697 | get_raw_output | 158ms | 2026-04-20T19:19:06 | |
| tc_0bcb1231 | get_raw_output | 157ms | 2026-04-20T19:19:06 | |
| tc_89dc97c1 | search | 219ms | 2026-04-20T19:19:06 | |
| tc_d281e229 | search | 65ms | 2026-04-20T19:19:41 | |
| tc_6523ef1f | search | 93ms | 2026-04-20T19:19:41 | |
| tc_63af4f9d | search | 111ms | 2026-04-20T19:19:41 | |
| tc_91642f03 | submit_finding | 351ms | 2026-04-20T19:19:41 | |
| tc_232752f3 | search | 422ms | 2026-04-20T19:19:41 | |
| tc_9c82319b | search | 46ms | 2026-04-20T19:20:07 | |
| tc_2b7351ca | get_raw_output | 138ms | 2026-04-20T19:20:07 | |
| tc_54973b4f | search | 401ms | 2026-04-20T19:20:07 | |
| tc_2a35aa1d | search | 771ms | 2026-04-20T19:20:07 | |
| tc_3db09fc3 | search | 1114ms | 2026-04-20T19:20:08 | |
| tc_6b141b36 | search | 34ms | 2026-04-20T19:20:35 | |
| tc_88c9e958 | search | 38ms | 2026-04-20T19:20:35 | |
| tc_b308698e | search | 39ms | 2026-04-20T19:20:35 | |
| tc_f44fd31f | search | 61ms | 2026-04-20T19:20:35 | |
| tc_506cfc2f | get_raw_output | 104ms | 2026-04-20T19:20:36 | |
| tc_8b57bf42 | search | 78ms | 2026-04-20T19:21:27 | |
| tc_5b2630a9 | submit_finding | 125ms | 2026-04-20T19:21:27 | |
| tc_3447026b | search | 404ms | 2026-04-20T19:21:27 | |
| tc_e9420b6e | submit_finding | 25ms | 2026-04-20T19:21:32 | |
| tc_515d2d3a | search | 33ms | 2026-04-20T19:21:46 | |
| tc_732960c0 | find_execution_evidence | 43ms | 2026-04-20T19:21:46 | |
| tc_e43f1183 | find_defense_evasion._search(all) | 42ms | 2026-04-20T19:21:46 | |
| tc_90c5d8d1 | find_defense_evasion._search(all) | 18ms | 2026-04-20T19:21:46 | |
| tc_7a46ed0f | find_defense_evasion._search(all) | 28ms | 2026-04-20T19:21:46 | |
| tc_2b46bcae | find_defense_evasion._search(all) | 30ms | 2026-04-20T19:21:46 | |
| tc_1928570b | find_defense_evasion._search(all) | 32ms | 2026-04-20T19:21:46 | |
| tc_31a5ab60 | find_defense_evasion | 210ms | 2026-04-20T19:21:46 | |
| tc_84a3dffd | find_persistence_mechanisms._query(registry.system) | 370ms | 2026-04-20T19:21:47 | |
| tc_ecf85c48 | find_persistence_mechanisms._query(registry.software) | 32ms | 2026-04-20T19:21:47 | |
| tc_9f63d709 | find_persistence_mechanisms._query(volatility.svcscan) | 30ms | 2026-04-20T19:21:47 | |
| tc_a79bc586 | find_persistence_mechanisms._search(all) | 10ms | 2026-04-20T19:21:47 | |
| tc_8f2619e9 | find_persistence_mechanisms._search(all) | 6ms | 2026-04-20T19:21:47 | |
| tc_29edba36 | find_persistence_mechanisms._search(all) | 11ms | 2026-04-20T19:21:47 | |
| tc_ed52d6f1 | find_persistence_mechanisms._query(tsk.filelist) | 303ms | 2026-04-20T19:21:47 | |
| tc_791449d4 | find_persistence_mechanisms | 811ms | 2026-04-20T19:21:47 | |
| tc_278cf59d | find_data_exfiltration_indicators._query(bulk.url) | 2390ms | 2026-04-20T19:21:49 | |
| tc_00914cbd | find_data_exfiltration_indicators._query(bulk.email) | 97ms | 2026-04-20T19:21:49 | |
| tc_daf5117c | find_data_exfiltration_indicators._query(bulk.domain) | 1040ms | 2026-04-20T19:21:50 | |
| tc_44026e34 | find_data_exfiltration_indicators._search(all) | 25ms | 2026-04-20T19:21:51 | |
| tc_c0aa4704 | find_data_exfiltration_indicators | 4573ms | 2026-04-20T19:21:51 | |
| tc_4462c4cd | start_extraction_batch | 2ms | 2026-04-20T19:22:18 | |
| tc_451cbf23 | run_amcache_parser | 537ms | 2026-04-20T19:22:18 | |
| tc_4bc6407e | analyze_execution_timeline | 37ms | 2026-04-20T19:22:24 | |
| tc_03590bbd | find_lateral_movement_indicators._search(all) | 51ms | 2026-04-20T19:22:24 | |
| tc_746d971a | find_lateral_movement_indicators._search(all) | 13ms | 2026-04-20T19:22:24 | |
| tc_16bd43a3 | find_lateral_movement_indicators._search(all) | 14ms | 2026-04-20T19:22:24 | |
| tc_0c86b9e5 | find_lateral_movement_indicators._query(volatility.netscan) | 265ms | 2026-04-20T19:22:24 | |
| tc_129db983 | run_shimcache_parser | 6885ms | 2026-04-20T19:22:25 | |
| tc_5e9239ed | find_lateral_movement_indicators._search(all) | 495ms | 2026-04-20T19:22:25 | |
| tc_7aadbf24 | find_lateral_movement_indicators._search(all) | 14ms | 2026-04-20T19:22:25 | |
| tc_6d1846d4 | find_lateral_movement_indicators._search(all) | 24ms | 2026-04-20T19:22:25 | |
| tc_292609d6 | find_lateral_movement_indicators | 917ms | 2026-04-20T19:22:25 | |
| tc_03df8a2d | correlate_across_sources | 5441ms | 2026-04-20T19:22:29 | |
| tc_fd34f427 | correlate_across_sources | 5441ms | 2026-04-20T19:22:29 | |
| tc_65e0ff65 | correlate_across_sources | 5442ms | 2026-04-20T19:22:29 | |
| tc_3f5c4c39 | correlate_across_sources | 5442ms | 2026-04-20T19:22:29 | |
| tc_b628aa42 | check_extraction_status | 0ms | 2026-04-20T19:24:20 | |
| tc_7c643834 | submit_finding | 17ms | 2026-04-20T19:24:20 | |
| tc_0a549483 | submit_finding | 21ms | 2026-04-20T19:24:20 | |
| tc_9bc2cf59 | submit_finding | 25ms | 2026-04-20T19:24:20 | |
| tc_56138596 | get_completed_results | 0ms | 2026-04-20T19:24:29 | |
| tc_115f5a71 | search | 58ms | 2026-04-20T19:25:02 | |
| tc_a6c2b7af | search | 56ms | 2026-04-20T19:25:02 | |
| tc_b3a4531c | search | 89ms | 2026-04-20T19:25:02 | |
| tc_6986f56d | search | 101ms | 2026-04-20T19:25:02 | |
| tc_b3e81b7b | get_raw_output | 258ms | 2026-04-20T19:25:02 | |
| tc_5a2c58bb | search | 415ms | 2026-04-20T19:25:03 | |
| tc_4e4f6369 | search | 69ms | 2026-04-20T19:25:23 | |
| tc_2099eb31 | search | 80ms | 2026-04-20T19:25:23 | |
| tc_36166e79 | search | 82ms | 2026-04-20T19:25:23 | |
| tc_194a3c10 | search | 100ms | 2026-04-20T19:25:23 | |
| tc_ca0e9fd4 | search | 477ms | 2026-04-20T19:25:24 | |
| tc_073e0053 | submit_finding | 17ms | 2026-04-20T19:26:03 | |
| tc_9edd829d | assess_recovery._query(tsk.filelist) | 396ms | 2026-04-20T19:26:04 | |
| tc_b84708b0 | assess_recovery | 432ms | 2026-04-20T19:26:04 | |
| tc_e75d0497 | audit_tool_coverage | 22ms | 2026-04-20T19:26:48 | |
| tc_b6080343 | audit_evidence_coverage | 871ms | 2026-04-20T19:26:49 | |
| tc_49d1d9ba | search | 116ms | 2026-04-20T19:27:12 | |
| tc_8a9e8351 | search | 163ms | 2026-04-20T19:27:12 | |
| tc_50d0fd7e | search | 326ms | 2026-04-20T19:27:12 | |
| tc_4c975bd2 | search | 329ms | 2026-04-20T19:27:12 | |
| tc_619112f4 | submit_finding | 18ms | 2026-04-20T19:28:11 | |
| tc_acaf8d2f | submit_finding | 22ms | 2026-04-20T19:28:11 | |
| tc_624fe5e5 | submit_narrative | 20ms | 2026-04-20T19:29:44 |
Each finding traces back to the specific tool calls that produced the supporting evidence.