2015-03-24 Disconnect USB Ejecting ‘RM#2’ 17:03 2015-03-24 Send an e-mail iaman.informant@nist.gov [ Subject: Done ] 17:05 “It’s done. See you tomorrow.” spy.conspirator@nist.gov 2015-03-24 Search keywords Searching keywords using Chrome “security checkpoint CD-R” 17:06 D-Day 2015-03-25 Search and download Searching apps for anti-forensics using IE Anti-forensic tools, eraser, 10:46 ccleaner… Apps 2015-03-25 Install Apps (1) Eraser (with .NET Framework) During approx. 8 minutes 10:50 (2) CCleaner 2015-03-25 Delete e-mails Deleting some e-mails in Outlook Anti-forensics 11:00 (9 emails are deleted, and 4 items of them remain in Deleted Items folder.) During approx. 10 minutes 2015-03-25 Delete traces Running anti-forensic tools and deleting Wiping “\Desktop\temp” directory 11:13 using Eraser some files 2015-03-25 Delete traces Emptying the Recycle Bin 11:14 2015-03-25 Normal deletion: [Shift] + [Delete] Delete traces Deleting downloaded installer files 11:15 (Eraser, CCleaner) 2015-03-25 Delete traces Launching CCleaner And then, the app was closed after doing nothing 11:15 2015-03-25 Delete Apps Uninstalling some Apps CCleaner, iCloud 11:18 During approx. 2 minutes 2015-03-25 Delete traces Launching Google Drive app and Logout from Google Drive 11:22 disconnecting an account 2015-03-25 Delete traces Cleaning and arranging Windows desktop Directories and icons in Windows Desktop 11:23 2015-03-25 Open files Opening the resignation letter (.docx) Windows Desktop 11:24 2015-03-25 Print files Printing the document to the MS XPS file 11:28 and reviewing it with MS XPS viewer 2015-03-25 RM#3 is one of two CD-Rs Finish works Turning off the system and trying to go 11:30 outside with ‘RM#2’ and ‘RM#3’
2015-03-24 17:03 Disconnect USB Ejecting ‘RM#2’ 2015-03-24 17:05 Send an e-mail iaman.informant@nist.gov spy.conspirator@nist.gov [ Subject: Done ] “It’s done. See you tomorrow.” 2015-03-24 17:06 Search keywords Searching keywords using Chrome “security checkpoint CD-R” D-Day 2015-03-25 10:46 Search and download Apps Searching apps for anti-forensics using IE Anti-forensic tools, eraser, ccleaner… 2015-03-25 10:50 Install Apps (1) Eraser (with .NET Framework) (2) CCleaner During approx. 8 minutes 2015-03-25 11:00 Delete e-mails Deleting some e-mails in Outlook Anti-forensics (9 emails are deleted, and 4 items of them remain in Deleted Items folder.) During approx. 10 minutes 2015-03-25 11:13 Delete traces Running anti-forensic tools and deleting some files Wiping “\Desktop\temp” directory using Eraser 2015-03-25 11:14 Delete traces Emptying the Recycle Bin 2015-03-25 11:15 Delete traces Deleting downloaded installer files (Eraser, CCleaner) Normal deletion: [Shift] + [Delete] 2015-03-25 11:15 Delete traces Launching CCleaner And then, the app was closed after doing nothing 2015-03-25 11:18 Delete Apps Uninstalling some Apps CCleaner, iCloud During approx. 2 minutes 2015-03-25 11:22 Delete traces Launching Google Drive app and disconnecting an account Logout from Google Drive 2015-03-25 11:23 Delete traces Cleaning and arranging Windows desktop Directories and icons in Windows Desktop 2015-03-25 11:24 Open files Opening the resignation letter (.docx) Windows Desktop 2015-03-25 11:28 Print files Printing the document to the MS XPS file and reviewing it with MS XPS viewer 2015-03-25 11:30 Finish works Turning off the system and trying to go outside with ‘RM#2’ and ‘RM#3’ RM#3 is one of two CD-Rs