$$ President: Pat McGoo

$$ Information Technology: Terry

$$ Patent Researchers: Jo$,$ Charlie

Note: In the above figure $$DOMEX$$ is the local server managing external network access and email.

One of the employees in M$57$ is stealing proprietary research from the company and passing it on to an outside

entity. This employee has taken some measures to cover their tracks, but probably did not count on the company

machines being imaged in the ongoing investigation of other criminal activity.

You are tasked with determining the following questions:

$$ Who is exfiltrating the data?

$$ How are they doing it$?$ Can you identify the specific items they have stolen? What is required to access

the data?

$$ Who is the outside contact?

$$ Is there anything in your analysis to suggest that this person might be charged with more than one

criminal offense?

At the end of your investigation you should prepare a report in order to find the above questions. You must find

relevant evidences after performing the investigation on the following images:

$$ charlie$-2009-12-11.$E$01$

$$ jo$-2009-12-11-001.$E$01$

$$ charlie$-$work$-$usb$-2009-12-11.$E$01$

$$ jo$-$work$-$usb$-2009-12-11.$E$01$

$$ terry$-$workusb$-2009-12-11.$E$01$

Your investigation should answer questions asked in the case and formulate a conclusion. Your conclusion

should be supported by your investigated evidence. Use the forensic software$$s you have learnt in the lab for

this investigation but if require feel free to use other available forensic tools available out there for free $($or trial$).$