Financial Security Case Studies
Sensitive Files Stolen By Bank Employee
Time-line analysis breaks case
A bank suspected an employee of downloading sensitive files from the
bank's computer network using his bank laptop computer from home while on
leave of absence. The bank sent the computer to NTI for computer forensic
examination.
A mirror image backup of the laptop's hard drive was made, and a
forensic NTI examination was conducted. obtained a listing of all deleted
and undeleted files from the mirror image backup and performed a search
for key words associated with the sensitive files suspected of being
downloaded. It was proved that certain sensitive files had been on the
laptop's hard drive.
A file listing time-line analysis was performed, and it showed that
numerous files were loaded on the computer while the employee was on leave
of absence and the laptop computer was in his possession. A network log
check was also performed with the help of the bank's computer systems
staff. This identified that the employee had been logged onto the network
during the times that the questioned files first appeared on the laptop.
Thanks to the evidence gathered and leads developed during NTI's
examination, the bank referred the case to the FBI for criminal
investigation.
« Previous |
Next
» | 
