COEN 152/252 Computer Forensics

1
COEN 152/252Computer Forensics

• Data Analysis Digital Images
• Santa Clara University
• School of Engineering
• COEN 152/252
• Thomas N. Scocca

2
Observations

• Folder located on subject forensic image after
  mounting in EnCase.
• Contained the following
• test00 002.jpg
• test00 004 copy.jpg
• test00 004.jpg
• test00 005 copy.jpg
• test00 006 copy.jpg
• test00 006.jpg
• test00 007 copy.jpg
• test00 007.jpg
• test00 008 copy.jpg
• test00 008.jpg
• Is there a reason to take a closer look?

3
test00 002.jpg
4
Check the detailsWinHex view of test00 002.jpg
5
test00 004.jpg
6
Check the detailsWinHex view of test00 004.jpg
7
test00 004 copy.jpg
8
Check the detailsWinHex view of test00 004
copy.jpg
9
test00 006.jpg
10
Check the detailsWinHex view of test00 006.jpg
11
test00 006 copy.jpg
12
Check the detailsWinHex view of test00 006
copy.jpg
13
Additional Indicators

• Presence of Adobe Photoshop software application
  on system.
• Registry entries indicated Photoshop had been
  used to open listed files.
• Contacted Finance group and found user had been
  part of a pilot program for submitting digitized
  versions of receipts instead of originals.

14
Next Steps

• Check with Legal to determine handling
• Law enforcement involvement or not?
• Civil prosecution for recovery of funds?
• Other

15
Questions
?