Deadbox investigation exercises: image a Windows disk through a write-blocker and reconstruct program execution, USB activity, and data exfiltration
Kestrel Aerospace's senior propulsion engineer, Daniel Ferris, resigned to join a competitor. Before his laptop was reissued, IT flagged unusual USB and browser activity on his last day. Image the drive through a write-blocker, verify the acquisition hash, and reconstruct what programs ran, what device was attached, and how far the data traveled, without altering the evidence.
A $340,000 wire from Halvorsen Machine Works to a longtime steel vendor bounced back as "account closed." The vendor never changed its bank. Accounts-payable clerk Priya Nandakumar's workstation is the only place the vendor master record was edited before the wire ran. Image the machine and determine how, when, and by whom the routing number changed.
A CNC machinist at Bellwether Foundry gave two days' notice and left for a direct competitor. His workstation's Prefetch folder is nearly empty for a machine in daily use since 2021, and a suspicious toolpath archive's timestamps don't line up with anything else on the disk. Determine what he actually did despite the apparent cleanup.
Contract engineer Elena Marchetti had time-boxed, logged access to a restricted CAD repository at Halvorsen Defense Systems during her final sprint. Her BitLocker-encrypted, Windows 10 LTSC laptop was returned with the recovery key on file, but corporate policy disables Prefetch and browser history on contractor devices. Determine whether she accessed and exfiltrated restricted design files despite those controls being off.
Thistledown Financial hired Marcus Ondrey as a senior risk analyst on the strength of a CISSP certificate dated 2016 and a reference letter from a prior manager. After he twice failed to explain basic control-framework questions on a client call, HR asks IT to determine whether the two PDFs he submitted during onboarding were fabricated on his own laptop shortly before he sent them.
A product manager at Bellwether Foundry deleted a folder of unreleased pricing sheets from her NVMe-equipped laptop the day before resigning. IT wants the files recovered. Determine what can and cannot be reconstructed from an SSD with TRIM enabled, and whether the case can still be made without recovering the file contents.
Halvorsen Machine Works' security team spotted a BitLocker suspension event on a departing buyer's laptop and assumed the encryption had been deliberately disabled to make exfiltration easier. Determine whether the suspension itself is evidence of anything, and, separately, whether any exfiltration actually happened on this machine.
A supervisor at Bellwether Foundry insists a machinist's workstation never ran the archiving tool implicated in a parts-design leak, because AmCache has no record of it. Determine whether AmCache's silence actually clears the tool, or whether something else explains the gap.
A senior mechanical engineer at Halvorsen Defense Systems ran a personal VirtualBox virtual machine on his company laptop for 'personal use', then deleted it the day he resigned. Determine what happened inside that VM despite it no longer existing on the disk.
Confidential reactor-seal engineering drawings went missing from Kestrel Aerospace's restricted vault in physical, printed form, no USB device, no cloud upload, no email attachment. Determine whether a workstation's print spooler can still prove what was printed and by whom, even though the pages themselves and the spool files are both long gone.