All Details

Case Details

Contact Details

Case Assets

Case Collection

Evidence Details

Case Photographs

Case Disposal

Forensic Hardware and Software

0384

Report Produced : 12/04/2019 11:57:52

Produced By :

Forensic Hardware and Software

0384

Report Produced : 12/04/2019 11:57:52

Produced By :

Case Details



<table border="1"><tr><td>Case Reference</td></tr><tr><td>IDMS Reference</td></tr><tr><td>Examiner</td></tr><tr><td>Case Service Level</td></tr><tr><td>Analysis Type</td></tr><tr><td>Case Classification Level</td></tr><tr><td>Service Level</td></tr><tr><td>Open Date/Time</td></tr><tr><td>Due Date/Time</td></tr><tr><td>Case Status</td></tr><tr><td>Contact Name</td></tr><tr><td>Assigned Staff Member Name</td></tr><tr><td>Record Status</td></tr></table>

Case Background

Background Attachment(s)

<table border="1"><tr><td>Technical Review</td></tr><tr><td>Technical Review</td></tr><tr><td>Appropriate examinations have been performed to address request</td></tr><tr><td>Report is clear and understandable</td></tr><tr><td>The procedures performed were adequately documented and forensically sound</td></tr><tr><td>Exam documentation was sufficiently detailed to enable reproduction of the results</td></tr></table>



0384

2019-010614



<table><tr><td>PRIORITY</td></tr><tr><td>Job Performance Failure</td></tr><tr><td>UNCLASSIFIED</td></tr><tr><td>7 Days</td></tr><tr><td>08/13/2019 08:10:46 (-0400)</td></tr><tr><td>08/20/2019 23:59:59 (-0400)</td></tr></table>



Unlocked

2 Desktop Computers submitted on

8/13/19;

2 additional desktop computers submitting on 8/21/19.

2019-010614 Request Form.pdf

Leonard Notes.docx

Yes

Yes

EFTA00128367

<table border="1"><tr><td>The interpretations and conclusions of the examiner were reasonable</td></tr><tr><td>Report is consistent with the examination documentation</td></tr><tr><td>When generally accepted examination tools are not used, are significant findings verified by the examiner?</td></tr><tr><td>Results media has been spot checked</td></tr><tr><td>Examiner performing review</td></tr><tr><td>Date of review</td></tr><tr><td>Contact Details</td></tr></table>

<table><thead><tr><th>Category</th><th>Description</th></tr></thead><tbody><tr><td>First Name</td><td></td></tr><tr><td>Last Name</td><td></td></tr><tr><td>Sector</td><td>New York Field Office</td></tr><tr><td>Primary Email</td><td></td></tr><tr><td>Authority Contact Name</td><td></td></tr><tr><td>Authority Contact Number</td><td>7034131860</td></tr><tr><td>Authority Contact Email</td><td></td></tr><tr><td>Authority Status</td><td>Approved</td></tr><tr><td>Case Assets</td><td></td></tr><tr><td colspan="2">Product Name Tableau TD2</td></tr><tr><td>Asset Tag</td><td>X29946</td></tr><tr><td>Case Process</td><td>Evidence Imaging - Write Blocker (0002)</td></tr><tr><td>Tracked Asset Yes</td><td></td></tr><tr><td>Asset Type</td><td>Hardware</td></tr><tr><td>Product Name Tableau TD2</td><td></td></tr><tr><td>Asset Tag</td><td>X29946</td></tr><tr><td>Case Process</td><td>Evidence Imaging - Write Blocker (0004)</td></tr><tr><td>Tracked Asset Yes</td><td></td></tr><tr><td>Asset Type</td><td>Hardware</td></tr><tr><td>Product Name Alienware</td><td></td></tr><tr><td>Asset Tag</td><td>X29717</td></tr><tr><td>Case Process</td><td>Unknown</td></tr><tr><td>Tracked Asset Yes</td><td></td></tr><tr><td>Asset Type</td><td>Hardware</td></tr><tr><td>Product Name Aegis Fortress</td><td></td></tr><tr><td>Asset Tag</td><td>101300010379</td></tr><tr><td>Case Process</td><td>Unknown</td></tr><tr><td>Tracked Asset Yes</td><td></td></tr><tr><td>Asset Type</td><td>Hardware</td></tr><tr><td>Case Collection</td><td></td></tr><tr><td>Collection Date/Time</td><td>08/11/2019 11:28:00 (-0400</td></tr><tr><td>Collection From</td><td></td></tr><tr><td>Collection Type</td><td>Collection</td></tr><tr><td>Method</td><td>Staff Collection</td></tr></tbody></table>

EFTA00128368

<table><thead><tr><th>Evidence Status</th><td>Complete</td></tr></thead><tbody><tr><td>Assigned Staff Member Name</td><td></td></tr><tr><td>Office</td><td>Cyber Investigations Office New York</td></tr><tr><td>Company</td><td>US Department of Justice Office of the Inspector General</td></tr><tr><td>CompanyAddress</td><td>1401 S Clark St.<br>Suite 900<br>Arlington<br>VA<br>22202<br>United States</td></tr><tr><td>Company Contact Name</td><td>Cyber Investigations Washington</td></tr><tr><td>Company Contact Number</td><td></td></tr><tr><td>Collected Exhibits</td><td></td></tr><tr><td>Evidence Reference 0001</td><td></td></tr><tr><td>Evidence Type</td><td>Desktop</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>HP EliteDesk 800 S/N: 2UA4381YNJ</td></tr><tr><td>Evidence Reference 0002</td><td></td></tr><tr><td>Evidence Type</td><td>Hard Drive</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>Seagate 500 GB SATA HDD S/N: Z6E8M349</td></tr><tr><td>Evidence Reference 0003</td><td></td></tr><tr><td>Evidence Type</td><td>Desktop</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>HP EliteDesk 800 S/N: 2UA4381YMW</td></tr><tr><td>Evidence Reference 0004</td><td></td></tr><tr><td>Evidence Type</td><td>Hard Drive</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>Seagate 500 GB SATA HDD S/N: Z6E8K1EV</td></tr><tr><td>Attachment(s)</td><td>ECD In.pdf</td></tr><tr><td>Collection Date/Time</td><td>08/21/2019 00:00:00 (-0400)</td></tr><tr><td>Collection From</td><td></td></tr><tr><td>Collection Type</td><td>Collection</td></tr><tr><td>Method</td><td>Staff Collection</td></tr><tr><td>Evidence Status</td><td>Complete</td></tr><tr><td>Assigned Staff Member Name</td><td></td></tr><tr><td>Office</td><td>New York Field Office</td></tr><tr><td>Company</td><td>US Department of Justice Office of the Inspector General</td></tr><tr><td>CompanyAddress</td><td>1 Battery Park Plaza<br>29th Floor<br>New York<br>New York<br>10004<br>United States</td></tr></tbody></table>

EFTA00128369

<table><thead><tr><th>Company Contact Name</th><th>New York Field Office</th></tr></thead><tbody><tr><td colspan="2">Collected Exhibits</td></tr><tr><td colspan="2">Evidence Reference 0005</td></tr><tr><td>Evidence Type</td><td>Desktop</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>HP EliteDesk 800 S/N: 2UA4381XJW</td></tr><tr><td colspan="2">Evidence Reference 0006</td></tr><tr><td>Evidence Type</td><td>Hard Drive</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>Seagate 500GB SATA HDD S/N: Z6E8KD3N</td></tr><tr><td colspan="2">Evidence Reference 0007</td></tr><tr><td>Evidence Type</td><td>Desktop</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>HP Compaq 8200 Elite</td></tr><tr><td colspan="2">Evidence Reference 0008</td></tr><tr><td>Evidence Type</td><td>Hard Drive</td></tr><tr><td>Seal Number</td><td>N/A</td></tr><tr><td>Description</td><td>Hitachi 500GB SATA HDD S/N: JP1572JE36LSNK</td></tr><tr><td>Attachment(s)</td><td>ECD in.pdf</td></tr><tr><td colspan="2">Evidence Details</td></tr><tr><td>Evidence Reference</td><td>0001</td></tr><tr><td>Evidence Type</td><td>Desktop</td></tr><tr><td>Logged In Date/Time</td><td>08/11/2019 04:15:35 (-0400)</td></tr><tr><td>Original Seal Number</td><td>N/A</td></tr><tr><td>Storage Location</td><td>Washington Vault</td></tr><tr><td>Priority</td><td>High</td></tr><tr><td>Description</td><td>HP EliteDesk 800 S/N: 2UA4381YNJ</td></tr><tr><td>Property Number</td><td>0214 207268</td></tr><tr><td>Seized Date/Time</td><td>08/11/2019 11:00:34 (-0400)</td></tr><tr><td colspan="2">Seized By/Produced By</td></tr><tr><td>Processing Result</td><td>N/A</td></tr><tr><td>Archived</td><td>No</td></tr><tr><td colspan="2">Pre-Imaging Details</td></tr><tr><td>Start Date/Time</td><td>08/14/2019 19:15:45 (-0400)</td></tr><tr><td>End Date/Time</td><td>08/14/2019 19:25:00 (-0400)</td></tr><tr><td colspan="2">Conducted By (Name)</td></tr><tr><td>Manufacturer</td><td>Hewlett Packard</td></tr><tr><td>Model</td><td>EliteDesk 800</td></tr><tr><td>Serial Number</td><td>2UA381YNJ</td></tr><tr><td>Casing Type</td><td>Workstation</td></tr><tr><td>Casing Colour</td><td>Black</td></tr><tr><td>BIOS Key</td><td>F10</td></tr><tr><td>BIOS Date/Time</td><td>08/14/2019 19:21</td></tr></tbody></table>

EFTA00128370

<table><thead><tr><th>Actual Date/Time</th><td>08/14/2019 19:21</td></tr></thead><tbody><tr><td>Password Protected</td><td>No</td></tr><tr><td>Attachment(s)</td><td>IMG_0075.JPG</td></tr><tr><td>Evidence Reference</td><td>0002</td></tr><tr><td>Evidence Type</td><td>Hard Drive</td></tr><tr><td>Logged In Date/Time</td><td>08/11/2019 04:15:35 (-0400)</td></tr><tr><td>Original Seal Number</td><td>N/A</td></tr><tr><td>Storage Location</td><td>Washington Vault</td></tr><tr><td>Priority</td><td>High</td></tr><tr><td>Description</td><td>Seagate 500 GB SATA HDD S/N: Z6E8M349</td></tr><tr><td>Property Number</td><td>N/A</td></tr><tr><td>Seized Date/Time</td><td>08/11/2019 11:00:30 (-0400)</td></tr><tr><td>Seized By/Produced By</td><td></td></tr><tr><td>Processing Result</td><td>N/A</td></tr><tr><td>Archived</td><td>No</td></tr><tr><td>Attachment(s)</td><td>Hash Match.jpg</td></tr><tr><td>Pre-Imaging Details</td><td></td></tr><tr><td>Start Date/Time</td><td>08/11/2019 16:00:00(-0400)</td></tr><tr><td>Conducted By (Name)</td><td></td></tr><tr><td>Manufacturer</td><td>Seagate</td></tr><tr><td>Model</td><td>ST500DM002</td></tr><tr><td>Serial Number</td><td>Z6E8M349</td></tr><tr><td>Type</td><td>SATA HDD</td></tr><tr><td>Notes</td><td>Drive removed from desktop 0214 207268 for imaging by Lidsky on 8/11/19 at CC lab.</td></tr><tr><td>Attachment(s)</td><td></td></tr><tr><td>Imaging Details</td><td></td></tr><tr><td>Start Date/Time</td><td>08/11/2019 16:40:28 (-0400)</td></tr><tr><td>End Date/Time</td><td>08/11/2019 18:14:00 (-0400)</td></tr><tr><td>Conducted By (Name)</td><td></td></tr><tr><td>Software Used</td><td>Tableau</td></tr><tr><td>Write Blocker</td><td>Tableau TD2 (X29946)</td></tr><tr><td>Image Type</td><td>E01</td></tr><tr><td>Compression</td><td>None</td></tr><tr><td>Block Size</td><td>64</td></tr><tr><td>Cyclic Redundancy Check (CRC)</td><td>64</td></tr><tr><td>MD5</td><td>13e7ad6132719bae78d849e3fb914ec2</td></tr><tr><td>SHA1</td><td>465c7bf5f62aebb6c98ecfc60534110f56274c25</td></tr><tr><td>Image Verified</td><td>No</td></tr><tr><td>Imaging Workstation</td><td>N/A</td></tr><tr><td>Notes</td><td>Imaging cancelled by Lidsky prior to verification completion. Subsequent hash match confirmed (see info under evidence details).</td></tr><tr><td></td><td>Imaging started: 2019-08-11 16:43<br>Imaging finished: 2019-08-11 18:14</td></tr></tbody></table>