John B. Baird

 

Computer Forensic Portfolio

Bradenton, FL

Currently Seeking Employment

Open to relocation

941-363-1144

johnbairdpc at gmail dot com

 

Draft Complete Case Notes

 

November 14th, 2012

 

10:20 AM: Created new EnCase case.

 

10:21 AM: Imported “cf.dd” compact flash drive image into EnCase.

 

10:21 AM: Saved EnCase case as “Draft Complete”.

 

10:22 AM: Exited EnCase and reopened EnCase.

 

10:23 AM: Reopened “Draft Complete” case.

 

10:23 AM: Away from computer, computer locked.

 

10:44 AM: Back to computer, computer unlocked.

 

10:44 AM: Started exploratory investigation.

 

10:47 AM: Discovered deleted image “_LUEPR~1.JPG” discovered on root directory depicting “DraftComplete HQ 101 Main Street Annapolis, MD”, which shows the layout of a building with sections labeled “Reception”, “Lab”, “Break Room”, “Vault” and “Shipping”. File was last accessed on 03/04/04, file created on 03/04/04 08:39:18PM, last written on 03/04/04 08:39:18PM.

 

10:50 AM: Discovered deleted image “_LUEPR~1.TIF” discovered on root directory depicting “DraftComplete HQ 101 Main Street Annapolis, MD”, which shows the layout of a building with sections labeled “Reception”, “Lab”, “Break Room”, “Vault” and “Shipping”. File was last accessed on 03/04/04, file created on 03/04/04 08:39:18PM, last written on 03/04/04 08:39:18PM.

 

10:51 AM: Discovered hidden file “NIKON001.DSC” on root directory, which indicates this compact flash memory card was used in a Nikon brand digital camera. File was last written on 03/04/04 09:11:12PM.

 

10:58 AM: Discovered file “DSCN2065.TIF” located in “DCIM/100NIKON”., depicting a golden necklace photographed on a blue, felt-looking cloth flat surface. File was created on 03/04/04 09:12:38PM, last written on 03/04/04 09:12:38PM.

 

11:01 AM: Discovered deleted “_NFO.TXT” file located in “DCIM/100NIKON”, which contains information from the digital camera used for this compact flash memory card. Contains information of photo settings used for various pictures taken with this digital camera. File was created on 03/04/04 09:15:08PM, last written on 03/04/04 09:15:08PM.

 

11:06 AM: Discovered deleted “_SCN2066.JPG” file located in “DCIM/100NIKON”, which contains an image of a pearl necklace with a gold claps photographed on a blue, felt-looking cloth flat surface. File was created on 03/04/04 09:13:22PM, last written on 03/04/04 09:13:22PM.

 

11:08 AM: Discovered deleted “_SCN2067.JPG” file located in “DCIM/100NIKON”, which contains an image of a gold rope-style bracelet, unhooked, photographed on a grey, felt-looking cloth flat surface. File was created on 03/04/04 09:13:58PM, last written on 03/04/04 09:13:58PM.

 

11:08 AM: Discovered deleted “_SCN2068.JPG” file located in “DCIM/100NIKON”, which contains an image of a gold thin ring with red / brown gem-looking stone, photographed on a grey, felt-looking cloth flat surface. File was created on 03/04/04 09:14:20PM, last written on 03/04/04 09:14:20PM.

 

11:08 AM: Discovered deleted “_SCN2069.JPG” file located in “DCIM/100NIKON”, which contains an image of a gold ring with raised top with a clear, diamond-like stone, photographed on a grey, felt-looking cloth flat surface. File was created on 03/04/04 09:15:08PM, last written on 03/04/04 09:15:08PM.

 

11:14 AM: Conducted search of compact flash drive image including keyword search using the terms “earnings, DraftComplete, necklace, jewelry, draft, complete”. Search resulted in no new information.

 

11:21 AM: Conducted search verifying signature mismatches targeting image files. Search resulted in no new information.

 

11:23 AM: Starting examination of hex data within files.

 

11:24 AM Discovered images taken within “DCIM/100NIKON” matches a Nikon model “Coolpix 5700”, evident from hex information containing the text “NIKON”, “E5700” and “e5700v1.0”.

 

11:29 AM: Discovered “_NFO.TXT” contains hex information that matches all image files found within “DCIM/100NIKON”. Contains the model of camera 5700, “E5700V1.0”.

 

11:32 AM: Discovered that the files found within “DCIM/100NIKON” that start with “_” were deleted and the start of the files started with the letter “D” but were changed to “_”. So “_SNC2066.JPG” was originally “DSCN2066.JPG”. This was likely done by the digital camera software and not by a user.

 

11:35 AM: Discovered hex information that indicates “_LUEPR~1.TIF” was created by a graphics program by Corel. The signature matches “Kodak Camera DC20/40/50”, but this does not mean the image was created with a digital camera but that the Corel graphics program created the TIF image to match this style of image encoding.

 

11:43 AM: Pausing forensic investigation.

 

11:44 AM: Saving and exiting EnCase “Draft Complete” case.

 

11:59 AM: Theory: the images were taken by employees for normal business and deleted by the digital camera when the images were no longer needed. Bruce Armiter likely copied the two layout files of the building but because the images were deleted, it is not likely he intended to use the files for anything. The only files not deleted or hidden was one image of a golden rope-style necklace, which appears to be created by the digital camera and not transferred from a computer. Because most users cannot access files once they are deleted and believe that when a file is deleted, that it is gone for good, it is likely Armiter did not have any nefarious intentions beyond possibly borrowing or stealing a compact flash memory card for personal use.

 

12:07 PM: Theory conclusion: Bruce Armiter was simply taking a practically blank compact flash memory card home for personal use.

 

12:10 PM: Crime committed theory conclusion: Suspected office supply theft.