All Details

All Details Case Details Contact Details Case Assets Case Collection Evidence Details Case Photographs Case Disposal Forensic Hardware and Sofware 0384 Report Produced : 12/04/2019 11:57:52 Produced By : Forensic Hardware and Sofware 0384 Report Produced : 12/04/2019 11:57:52 Produced By : Case Details Case Reference IDMS Reference Examiner Case Service Level Analysis Type Case Classification Level Service Level Open Date/Time Due Date/Time Case Status Contact Name Assigned Staff Member Name Record Status Case Background Background Attachment(s) Technical Review Technical Review Appropriate examinations have been performed to address request Report is clear and understandable The procedures performed were adequately documented and forensically sound Exam documentation was sufficiently detailed to enable reproduction of the results 0384 2019-010614 PRIORITY Job Performance Failure UNCLASSIFIED 7 Days 08/13/2019 08:10:46 (-0400) 08/20/2019 23:59:59 (-0400) Open Unlocked 2 Desktop Computers submitted on 8/13/19; 2 additional desktop computers submitting on 8/21/19. 2019-010614 Request Form.pdf Leonard Notes.docx Yes Yes Yes Yes Yes EFTA00128367 The interpretations and conclusions of the examiner were reasonable Report is consistent with the examination documentation When generally accepted examination tools are not used, are significant findings verified by the examiner? Results media has been spot checked Examiner performing review Date of review Contact Details First Name Last Name Sector Primary Email Authority Contact Name Authority Contact Number 7034131860 Authority Contact Email Authority Status Approved Case Assets New York Field Office Product Name Tableau TD2 Asset Tag X29946 Case Process Evidence Imaging - Write Blocker (0002) Tracked Asset Yes Asset Type Hardware Product Name Tableau TD2 Asset Tag X29946 Case Process Evidence Imaging - Write Blocker (0004) Tracked Asset Yes Asset Type Hardware Product Name Alienware Asset Tag X29717 Case Process Unknown Tracked Asset Yes Asset Type Hardware Product Name Aegis Fortress Asset Tag 101300010379 Case Process Unknown Tracked Asset Yes Asset Type Hardware Case Collection Collection Date/Time Collection From Collection Type Method 08/11/2019 11:28:00 (-0400) Collection Staff Collection Yes Yes Yes Yes ITS Canabal 09/11/2019 EFTA00128368 Evidence Status Complete Assigned Staff Member Name Office Cyber Investigations Office New York Company US Department of Justice Office of the Inspector General CompanyAddress 1401 S Clark St. Suite 900 Arlington VA 22202 United States Company Contact Name Cyber Investigations Washington Company Contact Number Collected Exhibits Evidence Reference 0001 Evidence Type Desktop Seal Number N/A Description HP EliteDesk 800 S/N: 2UA438IYNJ Evidence Reference 0002 Evidence Type Hard Drive Seal Number N/A Description Seagate 500 GB SATA HDD S/N: Z6E8M349 Evidence Reference 0003 Evidence Type Desktop Seal Number N/A Description HP EliteDesk 800 S/N: 2UA4381YMW Evidence Reference 0004 Evidence Type Hard Drive Seal Number N/A Description Seagate 500 GB SATA HDD S/N: Z6E8K1EV Attachment(s) El adf Collection Date/Time 08/21/2019 00:00:00 (-0400) Collection From Collection Type Collection Method Staff Collection Evidence Status Complete Assigned Staff Member Name Office New York Field Office Company US Department of Justice Office of the Inspector General CompanyAddress 1 Battery Park Plaza 29th Floor New York New York 10004 United States EFTA00128369 Company Contact Name New York Field Office Collected Exhibits Evidence Reference 0005 Evidence Type Desktop Seal Number N/A Description HP EliteDesk 800 S/N: 2UA438IXJW Evidence Reference 0006 Evidence Type Hard Drive Seal Number N/A Description Seagate 500GB SATA HDD SIN: Z6E8KD3N Evidence Reference 0007 Evidence Type Seal Number Description Desktop N/A HP Compaq 8200 Elite Evidence Reference 0008 Evidence Type Hard Drive Seal Number N/A Description Hitachi 500GB SATA HDD SIN: JP I572JE36LSNK Attachment(s) El apdf Evidence Details Evidence Reference Evidence Type Logged In Date/Time Original Seal Number Storage Location Priority Description Property Number Seized Date/Time Seized By/Produced By Processing Result Archived Pit-Imaging Details Start Date/Time End Date/Time Conducted By (Name) Manufacturer Model Serial Number Casing Type Casing Colour BIOS Key BIOS Date/Time 0001 Desktop 08/11/2019 04:15:35 (-0400) N/A Washington Vault High HP EliteDesk 800 S/N: 2UA4381YNJ 0214 207268 08/11/2019 11:00:34 (-0400) N/A No 08/14/2019 19:15:45 (-0400) 08/14/2019 19:25:00 (-0400) Hewlett Packard EliteDesk 800 2UA38 I YNJ Workstation Black FI0 08/14/2019 19:21 EFTA00128370 Actual Date/Time 08/14/2019 19:21 Password Protected No Attachment(s) IMG 0075.JPG Evidence Reference 0002 Evidence Type Hard Drive Logged In Date/Time 08/11/2019 04:15:35 (-0400) Original Seal Number N/A Storage Location Washington Vault Priority High Description Seagate 500 GB SATA HDD S/N: Z6E8M349 Property Number N/A Seized Date/Time 08/11/2019 11:00:30 (-0400) Seized By/Produced By Processing Result N/A Archived No Attachment(s) Hash Match.jpg Pre-Imaging Details Start Date/Time 08/11/2019 16:00:00(-0400) Conducted By (Name) Manufacturer Seagate Model ST500DM002 Serial Number Z6E8M349 Type SATA HDD Notes Drive removed from desktop 0214 207268 for imaging by Lidsky on 8/11/19 at CC lab. Attachment(s) Imaging Details Start Date/Time 08/11/2019 16:40:28 (-0400) End Date/Time 08/11/2019 18:14:00 (-0400) Conducted By (Name) Software Used Tableau Write Blocker Tableau TD2 (X29946) Image Type E01 Compression None Block Size 64 Cyclic Redundancy 64 Check (CRC) MD5 13e7ad6132719bae78d849e3fb914cc2 SHA1 465c7bf5f62aebb6c98ecfc60534110f56274c25 Image Verified No Imaging Workstation N/A Notes Imaging cancelled by Lidsky prior to verification completion. Subsequent hash match confirmed (see info under evidence details). Imaging started: 2019-08-11 16:43 Imaging finished: 2019-08-11 18:14 EFTA00128371 Tableau device serial number: 1 1d2003b Tableau firmware revision: 4.01 Tableau firmware timestamp: May 02 2013 21:35:47 Source device model: ST500DM002-1EID142 Source device serial number: Z6E8M349 Source device HPA in use: No Source device DCO in use: No Source device capacity reported Pwr-ON: 976,773,168 (500.1 GB) Source device capacity reported by HPA: 976,773,168 (500.1 GB) Source device capacity reported by DCO: 976,773,168 (500.1 GB) Attachment(s) 2019-08-11 16-43-11 00107 D2F.LOG Evidence Reference 0003 Evidence Type Desktop Logged In Date/Time 08/13/2019 09:00:35 (-0400) Original Seal Number N/A Storage Location Washington Vault Priority High Description HP EliteDesk 800 S/N: 2UA4381YMW Property Number 0214 207270 Seized Date/Time 08/11/2019 11:00:03 (-0400) Seized By/Produced By Processing Result N/A Archived No Pre-Imaging Details Start Date/Time 08/14/2019 19:00:00 (-0400) End Date/Time 08/14/2019 19:25:00 (-0400) Conducted By (Name) Manufacturer Hewlett Packard Model EliteDesk 800 Serial Number 2UA4381YMW Casing Type Workstation Casing Colour Black BIOS Key FI0 BIOS Date/Time 08/14/2019 19:18 Actual Date/Time 08/14/2019 19:18 Password Protected No Attachment(s) IMG 0073.JPG Evidence Reference 0004 Evidence Type Hard Drive Logged In Date/Time 08/13/2019 09:00:35 (-0400) Original Seal Number N/A Storage Location Washington Vault Priority High Description Seagate 500 GB SATA HDD S/N: Z6E8K1EV EFTA00128372 Property Number N/A Seized Date/Time Seized By/Produced By Processing Result Archived Pit-Imaging Details Start Date/Time Conducted By (Name) Manufacturer Model Serial Number Type Notes Attachment(s) Imaging Details Start Date/Time End Date/Time Conducted By (Name) Software Used Write Blocker Image Type Compression Block Size 08/11/2019 11:00:01 (-0400) N/A No 08/11/2019 16:00:00(-0400) Seagate ST500DM002 Z6E8K1EV SATA HDD Drive removed from desktop 0214 207270 for imaging by Lidsky on 8/11/19 at CC lab. 08/11/2019 18:17:11 (-0400) 08/11/2019 21:16:00 (-0400) Tableau Tableau TD2 (X29946) E01 None 64 Cyclic Redundancy Check (CRC) 64 MD5 SHAT Image Verified Imaging Workstation Notes Attachment(s) Case Photographs 0001: IMG_0046.JPG 2,3893_IMG_0046.JPG 481956e5ddab702d48177534ec96d026 be9791bce5978ccdf3111a54eac84606739c0424 No N/A Imaging started: 2019-08-11 18:17 Imaging finished: 2019-08-11 21:16 Tableau device serial number: 11d2003b Tableau firmware revision: 4.01 Tableau firmware timestamp: May 02 2013 21:35:47 Source device model: ST500DM002-1BD142 Source device serial number: Z6E8K1EV Source device HPA in use: No Source device DCO in use: No Source device capacity reported Pwr-ON: 976,773,168 (500.1 GB) Source device capacity reported by HPA: 976,773,168 (500.1 GB) Source device capacity reported by DCO: 976,773,168 (500.1 GB) 2019-08-11 18-17-23 00108 D2F.LOG EFTA00128373 0001: IMG_0047.JPG g13894_IMG_0047.JPG 0001: IMG_0048.JPG g',3895_IMG_0048.JPG 0001: IMG_0049.JPG g',3896_IMG_0049.JPG 0001: IMG_0050.JPG 2,3897_IMG_0050.JPG 0001: IMG_0051.JPG g13898_IMG_0051.JPG 0001: IMG_0052.JPG g',3899_IMG_0052.JPG 0001: IMG_0053.JPG 2,3900_IMG_0053.JPG 0001: IMG_0054.JPG 2,3901_IMG_0054.JPG 0001: IMG_0055.JPG 2,3902_IMG_0055.JPG 0001: IMG_0056.JPG g',3903_IMG_0056.JPG 0001: IMG_0057.JPG g13916_IMG_0057.JPG 0002: IMG_0058.JPG 2,3904_IMG_0058.JPG 0002: IMG_0059.JPG 2,3905_IMG_0059.JPG 0002: IMG_0057.JPG 2,3920_IMG_0057.JPG 0003: IMG_0060.JPG 2,3906_IMG_0060.JPG 0003: IMG_0061.JPG 2,3907_IMG_0061.JPG 0003: IMG_0062.JPG g',3908_IMG_0062.JPG 0003: IMG_0063.JPG g13909_IMG_0063.JPG 0003: IMG_0064.JPG g13910_IMG_0064.JPG 0003: IMG_0065.JPG ;t3911_IMG_0065.JPG 0003: IMG_0066.JPG 2,3912_IMG_0066.JPG 0003: IMG_0067.JPG 2,3913_IMG_0067.JPG 0003: IMG_0068.JPG 2,3914_IMG_0068.JPG 0003: IMG_0069.JPG ;t3915_1MG_0069.JPG 0004: IMG_0069.JPG g13917_IMG_0069.JPG 0004: IMG_0070.JPG g13918_IMG_0070.JPG 0004: IMG_0071.JPG 2,3919_IMG_0071.JPG EFTA00128374 Case Disposal EFTA00128375