Deadbox investigation exercises: image a Windows disk through a write-blocker and reconstruct program execution, USB activity, and data exfiltration
Kestrel Aerospace's senior propulsion engineer, Daniel Ferris, resigned to join a competitor. Before his laptop was reissued, IT flagged unusual USB and browser activity on his last day. Image the drive through a write-blocker, verify the acquisition hash, and reconstruct what programs ran, what device was attached, and how far the data traveled, without altering the evidence.