Larry, $28,$ was arrested yesterday on charges of industrial espionage. He is working for an IT start up company which is growing fast. His colleagues were suspicious that he is trying to sell the source code of their latest application to the competitors. They reported him to the manager. Manager hired a private detector, James, to approach to him as the buyer and give the highest bid. They exchanged some message and were able to force Larry to confess he is selling the codes. Then they reported him to the law enforcement. The police need your help. They want you to try to and determine if Larry has been selling other propriety data to competitors. Larry has denied selling other propriety data and refuses to provide the police with the name of the companies which made the offer. Larry also refuses to validate that he accepted the offer from James, right before his arrest. Upon issuing a search warrant and searching of the suspect's office, the police seized a USB, beside a

computer and a laptop. The police have imaged the suspect's USB and have provided you with an image of the USB.

They would like you to examine the USB and provide answers to the previous questions. The police would like you to pay special attention to any information that might prove that Larry was in fact selling codes to other companies. They would also like you to try to and determine, if possible, who the other bidders are. Larry posted bail set at $$10,000\mathrm{.}00.$ Afraid he may skip town; the police would like to get him locked up as soon as possible. To do so$,$the police have asked that you have the results fully completed. Please provide the police with a strong case consisting of your findings, where thefindings are located on the disk, processes and techniques used, and any actions that thesuspect may have taken to intentionally delete, hide and$/$or alter data on the USB.

Based on the following case$-$study, you need to compile a FULL forensics report with

screenshots $($visible wallpaper$)$ and explanations that answers following questions.

Note $1$: Please note that you can use any Hex editor program for this investigation, but only

hex editors, not other software$$s$.$

Note $2$: You are the investigator providing a report for the police. You cannot make a claim.

You are just talking about your findings, your processes and answering their questions.

$1.$ Who are the other bidders if any?

$2.$ What $($if any$)$ other data besides this $$application source code$$ did Larry sell?

$3.$ For each file, what processes were taken by the suspect to mask them from others?

$4.$ What other files did you recover and are they related to this investigation?

$5.$ What processes did you $($the investigator$)$ use to successfully examine the entire contents of each file?