Digital Forensic Investigation Reports — Three Case Studies in Host, File-System, and Network Forensic Analysis. Author: Diana J. Hakim, Cybersecurity & IT Developer. Date: September 30, 2025. This document summarizes three digital forensic investigations — host forensics on an abandoned workstation, file-system forensics on a seized USB key tied to corporate intellectual-property theft, and network forensics on an enterprise ransomware compromise — the techniques and methodology each one required, and the lessons they offer for defenders and incident responders.
1. When Artifacts Tell the Story
Digital forensics is the discipline of turning the invisible into the undeniable. A deleted file, a stray browser query, a suspicious TLS session — each is a fragment. The examiner’s job is to assemble those fragments into a narrative that holds up under scrutiny.
Over the past several months I completed three distinct investigations that, taken together, illustrate the full breadth of the discipline: host forensics on an abandoned workstation, file-system forensics on a seized USB key tied to corporate espionage, and network forensics on an enterprise ransomware compromise. Each case required a different toolset, a different methodology, and a different chain of reasoning — but all three shared the same principle: follow the evidence, not the assumption.
This post summarizes the three cases, the techniques each required, and the lessons they offer for defenders, incident responders, and anyone building a security practice.
2. Case 1: The “Subzero” Workstation
What We Found
An abandoned ASUS laptop running Ubuntu 12.04.2 LTS was recovered from a university library. The machine belonged to a user account named “Alex” — operating under the online handle “subzero” — and it was anything but idle.
A custom Bash script I wrote (system_information.sh) collected the foundational system profile: install date of April 30, 2013, 35 user accounts, hostname mean-machine, and an Intel 82540EM Gigabit Ethernet controller on eth2 at 10.0.2.15. That gave us the baseline. The interesting parts came next.
The Browsing History Told the Story
Firefox’s places.sqlite database was exported to history.txt and it revealed a clear progression from casual research to operational preparation:
google.com/search?q=python+botnet→ GitHub repositories forcoleifer/irc, including thebotnetandbotssubdirectories, and a download of the master ZIP.google.com/search?q=ddos+WITH+HPING→ a Pastebin tutorial with a working SYN-flood command:hping -i u1 -S -p 80 dst-host-or-ip.packetstormsecurity.com— regular visits to a well-known exploit and malware advisory site.google.com/search?q=EMAIL+DATASET— reconnaissance into mass-email target lists.- Facebook profile of a university professor (CryShame.JWS) — potentially target research.
Interleaved with these were perfectly mundane searches: BBC News, CNN, Fox News, movie wallpapers, and funny-picture queries. That mix is itself significant — it shows the machine was used as a daily driver, not a dedicated “hacking box.” The malicious activity was woven into ordinary life.
The Recycle Bin Was the Smoking Gun
The trash directory ~/.local/share/Trash/files/ held 29 files. Twenty-eight of them were .bin files named after known malware families:
| Family | Count |
|---|---|
| Swizzor | 8 |
| NothingFound | 7 |
| VB | 3 |
| Cinmus | 2 |
| Tdss | 1 |
| Mydoom | 1 |
| Krap | 1 |
| Agent | 1 |
| Basun | 1 |
| Turkojan | 1 |
| AutoIt | 1 |
Plus a single 38 MB archive: HD Wallpapers.zip. Classic decoy naming — a large, benign-looking bundle that could conceal payloads, exfiltrated data, or both.
The Toolkit Beyond the Trash
Additional evidence extended well past the recycle bin:
~/Documents/School/Courses/CS426/Botnet/— versioned botnet project files (bonet v1.1throughv1.4), evidence of active development, not just tool collection.~/Documents/School/Courses/CS310/Hack Game/— practice environment, with a re-used passwordfatman_(a common operational-security failure).~/Documents/TO do/4b59dbe49ec0205e372ae58f/— a randomly named directory, a standard technique for hiding sensitive material from casual inspection.- Installed tools: Zenmap (Nmap GUI), Transmission BitTorrent, Remmina (remote desktop), and Bro 1.5.3 (network monitoring — suggesting the user also studied defensive countermeasures).
Profiling the Operator
Correlating directory structures, $LANG settings (en_CA.UTF-8), timezone (PDT), and academic course codes (CS310, CS426, CSC 586E, Seng 422) produced a clear profile:
- Status: Upper-year Computer Science / Software Engineering student
- Location: British Columbia, Canada
- Skill level: Beyond “script kiddie” — capable of writing Python botnets and shell scripts, and aware of anti-forensic concealment
- Motivation: Malicious hacking and botnet deployment
Takeaway
Abandoned hardware is a goldmine. The suspect’s operational security was inconsistent: real anti-forensic effort (random folder names, decoy archives) sat alongside glaring mistakes (malware still in the recycle bin, a downloaded DDoS tutorial in browser history, a re-used password). Real-world attackers are rarely as careful as the threat models suggest.
3. Case 2: The Freescale USB — Steganography and IP Theft
The Setup
Freescale Semiconductor Cybernetics Inc. requested a forensic examination of a USB key seized from Ms. Emma Hancock. The question: did she exfiltrate company data?
An intercepted email provided the roadmap before we even touched the drive:
Some great development in the last period. Please visit our common friend for more. The password can be recovered from the file with the same name. Thank you, E.H.
Every phrase was a clue. “Common friend” — a file or folder. “The file with the same name” — the password was hidden in a file that shared its name with the encrypted container. This wasn’t vague corporate suspicion; it was a set of access instructions.
Integrity First
Before any analysis, FTK Imager was used to verify the forensic image (DatabreachUSB.001) against the MD5 and SHA-1 hashes in ImageHashes.txt. Both matched. The chain of custody was intact — no defense attorney could claim the image had been altered.
The GARDENING Folder
Six files, five of them benign PDFs about bioenergy, climate change, and agriculture. One stood out:
Freescale_board_meeting_2016-01-15_minutes-confidential.docx — a legitimate Office document (hex 50 4B 03 04, matching the expected ZIP-based DOCX signature), but with the DOS hidden attribute enabled and buried among gardening papers. This was misdirection, not encryption — an attempt to survive a casual browse.
The sixth file was more troubling: !XCWP.PDF, marked as highly suspicious because its expected PDF header (25 50 44 46) was absent. It had been deleted and partially overwritten.
The WORKSHOP Folder — Where the Real Theft Lived
The WORKSHOP folder contained sixteen files, most of them legitimate JPEGs. Three were not:
| File | Actual Hex | Expected Hex | Conclusion |
|---|---|---|---|
blade-runner.jpg (234 KB) | 37 7A BC AF | FF D8 FF E0 | 7-Zip archive disguised as JPEG |
sunsetRainbow.jpg (518 KB) | 42 4D 36 E6 | FF D8 FF E0 | BMP file disguised as JPEG |
blade-runner.jpg (10.7 KB) | FF D8 FF E0 | FF D8 FF E0 | Legitimate JPEG — the password host |
The Three-Layer Unwrap
Layer 1 — The container. blade-runner.jpg (the 234 KB version) wasn’t a JPEG at all. FTK Imager’s hex viewer showed the 37 7A BC AF signature — a 7-Zip archive. Classic file extension spoofing.
Layer 2 — The password. Following the email’s instructions, the other blade-runner.jpg (the 10.7 KB legitimate image) was analyzed with QuickStego. Embedded in it was the plaintext password: letmein!. A second copy of the same password was found in sunsetRainbow.jpg, suggesting redundancy or practice.
Layer 3 — The payload. Opening the disguised 7z archive with the recovered password revealed the crown jewel: MXCWP_design-confidential.pdf — proprietary Freescale MXC architecture documentation, including:
- Vector calculation algorithms
- Peak detection and trough analysis methodology
- Global MXC gain calculations (incorporating quantum mechanical principles)
- Complete platform architecture specifications
The Hidden Fourth Layer: Evidence Destruction
Here’s where the case turned from theft to premeditated theft. Using Autopsy and FTK Imager metadata analysis, two files were found to occupy the same physical location:
| File | Status | Start Cluster | Start Sector |
|---|---|---|---|
blade-runner.jpg | Allocated | 1,336 | 40,226 |
!XCWP.PDF | Deleted | 1,336 | 40,226 |
The timeline told the story: !XCWP.PDF was created at 7:21 PM, then deleted. blade-runner.jpg was created at 8:26 PM — in the exact same physical sector. This wasn’t accidental. It was deliberate data wiping, overwriting the original file’s sectors to make forensic recovery impossible.
Takeaway
This case is a masterclass in layered concealment: folder misdirection → hidden attributes → file extension spoofing → steganography → AES-256 encryption → physical overwrite. And yet the whole scheme was undone by a single intercepted email whose instructions lined up perfectly with the artifacts on the drive. Operational security is only as strong as its weakest layer — and email is usually the weakest layer.
4. Case 3: Neutrino Exploit Kit Ransomware
The Compromise in One Paragraph
A Windows 7 workstation (Brock-PC, 172.16.174.93) was compromised by the Neutrino Exploit Kit after the user visited a legitimate travel site whose advertising network served a malicious redirect. The EK dropped a Flash exploit, established encrypted C2, deployed ransomware, and maintained persistent covert communication through a Tor2web proxy. Every phase was captured in a packet trace — this case is a complete walkthrough of a modern web-based attack chain.
The Full Kill Chain
Phase 1 — Setup. DHCP offer/ack assigns the IP. LLMNR and NBNS broadcasts announce Brock-PC on the network.
Phase 2 — Connectivity checks. Windows NCSI reaches out to www.msftncsi.com and settings-win.data.microsoft.com to confirm internet access. Normal background traffic.
Phase 3 — Legitimate browsing. The user visits www.asiatravel.com/hongkong/. jQuery, CSS, and hotel imagery load. Third-party trackers fire: Google Analytics, Optimizely, DoubleClick, AdRoll, Kissmetrics. This is where the attacker lives.
Phase 4 — Compromise. A poisoned ad script triggers NBNS queries for WPAD — anomalous behavior for a public website. The script tries to disguise a redirect through the Bing API (api.bing.com?query=http%3A%2F%2Fhongkonghotels.org%2F), gets blocked by a firewall (RST, ACK), and falls back to a direct connection to hongkonghotels.org. That page contains a hidden iframe positioned at top:-1070px — invisible to the user — loading the Neutrino EK landing page from:
tilisinga-ismaeliet.starlightsteps.org.uk (5.135.252.130)
Phase 5 — Exploitation and C2. The EK serves two files:
weep-common-hope-wake.html(2,366 bytes) — browser fingerprinting. 12/63 vendors flagged it asHTML/Neutrino.e.slip-shrug-flap-able.swf— the Flash exploit. 2/58 vendors flagged it as a Neutrino component.
The malware then establishes encrypted C2 channels to 85.14.243.9 and pivots to AWS (52.85.89.144) to retrieve additional components. A ransom note is captured in the decrypted traffic.
Phase 6 — Covert C2 and exfiltration. The malware queries Bing’s API for the Tor gateway address ccjlwb22w6c22p2k.onion.to, resolves it to 217.197.83.197, and establishes parallel TLS sessions on ports 49276–49280. Inside those sessions, Wireshark starts flagging packets as “Ignored Unknown Record” — the attacker is embedding a covert C2 protocol inside TLS, defeating deep packet inspection.
The Infected Host Profile
| Characteristic | Value | Evidence |
|---|---|---|
| IP Address | 172.16.174.93 | Source of malicious HTTP requests |
| Host Name | Brock-PC | DHCP Inform (Packet 19), LLMNR (Packet 3) |
| MAC Address | 5c:26:0a:83:b1:d5 | Packet 2347 |
| OS | Windows 7 | User-Agent (NT 6.1) |
| Browser | Internet Explorer 11 | User-Agent (Trident/7.0, rv:11.0) |
| Device | Dell | MAC prefix Dell_83:b1:d5 |
The Initial Trigger
The user’s visit to www.asiatravel.com (192.229.162.42) was the causal event. The malicious ad, the redirect to hongkonghotels.org, the hidden iframe, the EK landing page, the Flash exploit, the C2, the Tor proxy, the ransomware — all of it traces back to one ordinary hotel-booking search.
The Evasion Techniques
What makes this case worth studying:
- Malvertising — legitimate ad networks weaponized.
- Bing API abuse — legitimate services used as redirect cover.
- Invisible iframe — CSS positioning to hide exploit code from the user.
- Domain fronting — C2 traffic disguised as Microsoft telemetry.
- AWS-hosted infrastructure — malicious content on trusted cloud platforms.
- Tor2web proxy — Tor anonymity without a Tor client.
- Protocol obfuscation — covert C2 buried inside TLS.
- Graceful session teardown — avoiding the abrupt RSTs that trigger alerts.
Remediation Lessons
The report’s mitigation section applies broadly to any organization:
- Isolate immediately. Cut C2 before it can exfiltrate or encrypt.
- Block at the firewall. Every malicious IP and domain in the chain.
- Rebuild, don’t clean. Multi-stage EK compromises invalidate OS integrity.
- Reset credentials. Assume everything typed on the machine is compromised.
- Kill Flash. Disable it permanently. Migrate off IE 11 and Windows 7.
- Fix WPAD and ISATAP. Disable or properly configure them to eliminate the spoofing surface.
- Deploy DNS filtering and EDR. Catch the next attempt earlier.
5. Cross-Case Themes
Three very different investigations, one shared methodology:
5.1 Chain of Custody Is Non-Negotiable
Every case started with hash verification. FTK Imager’s MD5 and SHA-1 match for DatabreachUSB.001 was the foundation for every subsequent finding in Case 2. Break that link and the entire report becomes inadmissible.
5.2 Anti-Forensics Is Rarely Complete
Case 1’s suspect used random folder names and decoy archives — but left malware in the recycle bin and a DDoS tutorial in browser history. Case 2’s suspect used steganography, AES-256, and physical wiping — but sent an email explaining the whole scheme. Attackers are human. They make mistakes.
5.3 Layered Evidence Wins
No single artifact convicted anyone. Case 1 needed the browser history and the trash contents and the botnet directory. Case 2 needed the email and the hex signatures and the steganographic extraction and the cluster-overlap analysis. Case 3 needed endpoint statistics and packet-level inspection and VirusTotal corroboration. Corroboration across independent sources is what makes a finding defensible.
5.4 The Weakest Link Is Usually Human
A library laptop left behind. An email sent with explicit instructions. A user who clicked a hotel ad. The technology is sophisticated on the attacker’s side; the failure points are almost always human.
6. Tools Referenced
For anyone building a similar practice, these were the workhorses across all three cases:
| Tool | Purpose |
|---|---|
| FTK Imager | Forensic imaging, hash verification, hex signature analysis |
| Autopsy | File-system metadata, cluster/sector conflict detection |
| QuickStego | Steganographic extraction |
| Wireshark | Deep packet inspection, protocol hierarchy, endpoint statistics |
| 7-Zip | Encrypted archive extraction |
| VirusTotal | Multi-engine malware corroboration |
| Nmap / Zenmap | Network reconnaissance (also found on suspect machine) |
| Bro / Zeek | Network security monitoring |
7. Final Thoughts
These three cases span the forensic spectrum — from a student’s messy laptop to a coordinated corporate theft to a fully automated exploit chain. What unites them is the discipline itself: validate the evidence, follow the bits, corroborate across sources, and let the artifacts speak for themselves.
The full technical report, including all packet ranges, hash values, hex signatures, and step-by-step methodology, is available on request. If you’re working on an incident response engagement, building a forensic lab, or studying for a certification — reach out. I’m always happy to talk methodology.