Case one - Electronic eavesdropping M57.biz is a new company that researches patent information for clients. Facts of the case: • 1 president / CEO • 3 additional employees • The firm is planning to hire more employees, so they have a lot of inventory on hand (computers, printers, etc). Current employees: • President: Pat McGoo • Information Technology: Terry • Patent Researchers: Jo, Charlie Employees work onsite, and conduct most business exchanges over email. All of the employees work in Windows environments, although each employee prefers different software (e.g. Outlook vs. Thunderbird). Figure 1: Network configuration for M57.biz Note: In the above figure "DOMEX" is the local server managing external network access and email. One of the M57 employees is spying on the boss (Pat McGoo) electronically. This employee is concerned that Pat may find out about certain activities they have engaged in - activities that may be related (directly or indirectly) to another ongoing investigation. You are tasked with determining the following: • Who is spying on Pat?• How are they doing it? Can you identify specific methods or software they have used to facilitate this? • Why is the employee spying on Pat? • Is anyone else involved? Would you characterize them as accomplices? At the end of your investigation you should prepare a report based on the details provided in the assignment two. Electronic identities: Pat McGoo (President): [email protected] (email password: mcgoo01) Terry Johnson (IT Administrator): [email protected] (email password: johnson01) Jo Smith (Patent Researcher): [email protected] (email password: smith01) Charlie Brown (Patent Researcher): [email protected] (email password: brown01) Corpus and Supporting Documents: Hard drive images from all workstations in the office for Sub-section 1: charlie-2009-12-11.E01, jo- 2009-12-11-002.E01, pat-2009-12-11.E01, terry-2009-12-11-002.E01 Tools like: FTK, SleuthKit, autopsy and EnCase can be really helpful to investigate this case Download link for hard drive images from all workstations in the office for Subsection 1: http://digitalcorpora.org/corpora/scenarios/2009-m57-patents/drivesredacted/