Seized USB and Spoofed Email Complaint
A businessman reports an email from '[email protected]' instructing him to transfer ₹8,00,000 to a new account. His real director uses '[email protected]'. The message header shows SPF fail, DKIM none, originating IP 203.0.113.45, and Reply-To: [email protected]. The attachment 'invoice.exe' was opened on the office Windows PC. The complainant then copied a folder named 'director' to a USB drive and handed it to police. A suspect's USB is seized from a cyber café. Its folder timestamps read 2024-03-10 18:22, but the café PC clock is set two hours ahead. The USB contains a text file with the same bank account number and a screenshot of the fake email. The cyber café owner says the suspect used PC-3 from 17:50 to 18:40. Police have not yet imaged the office PC or the café PC.
1. What preservation steps should be taken before anyone opens the USB or the office PC? Explain why each step matters.
Read the worked answer
Preservation comes before analysis.
- Photograph and label the USB, note serial number and condition, and place it in an antistatic evidence bag.
- Do not open files from the original. Use a write blocker and a forensic workstation to make a bit-stream image; compute SHA-256 of the original and of the image; verify hashes match.
- Make a working copy and keep the original sealed. Record every transfer on a chain-of-custody form.
- For the office PC, isolate it from the network but do not boot it if it is off. If it is on, consider capturing volatile data such as running processes and network connections before shutdown. Image the disk before inspecting files.
- For the café PC, preserve browser history, event logs, and CCTV before the owner overwrites them. Note the 2-hour clock offset. These steps matter because opening a file can change access timestamps and because hash verification shows the copy is authentic.
2. How should the file timestamps, email header, and screenshot be weighed? State what can and cannot be concluded.
Read the worked answer
Timestamps: the USB folder shows 18:22, but the café PC clock is two hours ahead. If the file was written on that PC, actual local time is about 16:22, not 18:22. File times also change when files are copied; creation time may reflect the copy, not the original. The timestamp therefore cannot by itself place the suspect at the keyboard. Email header: SPF fail and no DKIM support a spoofed sender, and the Reply-To mismatch is a red flag. But the originating IP 203.0.113.45 may be a VPN, proxy, or shared NAT, so it does not prove the suspect sent it. Screenshot: easily edited; it shows content, not transmission. The bank account number is a lead, not proof. Conclusion: the USB and header are corroborative, not conclusive. Police need mail-server logs, bank KYC, café CCTV, browser history, and device artefacts linking the suspect to the fake domain.
3. Write a short chain-of-custody and hash note that an officer could place in the case file for the USB.
Read the worked answer
Chain-of-custody and hash note (template):
- Exhibit: one USB drive, make/model/serial no. ..., seized on 2024-03-11 at 15:40 from [place] by [officer, rank, ID], in the presence of [witness].
- Condition: sealed in antistatic bag, seal no. ...; photographed.
- Imaging: performed on 2024-03-11 at 17:05 by [examiner] using write blocker [ID] and tool [name/version]. SHA-256 of original: [value]. SHA-256 of image: [value]. Hashes matched.
- Storage: original in evidence locker [no.]; working copy in forensic server [path].
- Transfers: date/time, from/to, purpose, signatures. The note must be contemporaneous and must not be altered later without a documented reason. If a hash changes, the copy is not reliable and the examination must stop.