Free Essay with a Report on the Intellectual Property Theft

Examiner: Titus Cook (IT consultant, Boss enterprise)

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Order now

Internal investigation team: Mark Galloway, (Technical assistant, the Boss end.), Seth Rolling (IT lead), Bill Goldberg (IT manager).

Requester: Boss Enterprise

Offense: intellectual property theft

Conclusion

The forensic investigation concluded that Dean Ambrose who until the case was working as the ICT lead in the Boss Enterprise obtained sensitive information from the company's IT executive personal computer and sold it a competing company. The information was extracted using an external storage device transferred to his personal computer and the information was later sent via email using the computer network to transfer the information to a third party. The information transferred is an intellectual property of the company and its transfer will jeopardize the operations of the company.

Overview

On 10th of April, Tom Hicks the Information Technology Director of Boss Enterprise contacted me concerning an allegation he was raised against one of the employees about an intellectual theft of sensitive information from his personal computer. Tom Hicks wanted the investigation to commence immediately and the case is cross-examined to determine the kind of files he believed the suspect stole from the computer for him to know the steps that he would take to mitigate e the risk. According to Tom Hicks, the information stolen from his personal PC might cost the collapse of their company if it falls in the hands of their competitors who might see it to overtake them in the market and bring them down. He believes that the information is worth millions of dollars and the suspect might have been paid to steal the information. Hicks states that he knows his PC was tampered due to the fact that he found traces of unauthorized entry such as tampered files, changed screen lock, and disorganized desk. Checking the CCTV footage showed that Mr. Dean Ambrose gained entrance into his office. Mr. Hicks wants a forensic investigation carried out and the evidence to be wrote down in a report that will be used to file a case against the suspect for legal action and secondly to determine the amount of information stolen from his office for him to present a report to the board of the security breach also to enable them to take right precaution to prevent any such occurrence in the future.

Forensic acquisition

The investigators began a forensic acquisition of the evidence presented to them; the investigator took photographs of the personal laptop of Mr. Hicks for any visible damages, unique marking, and documentation such as the serial number, model and make.

The investigator used sterile storage forensic equipment that has been forensically sterilized to prevent tampering of the evidence to collect the hash value of the laptop which is supposed to match with the hash value of such a device.

The investigator extracted the hard disk drive from Mr. Hick's laptop and later connected it to his forensic investigation device which happens to run on most sophisticated software that would track all the processes and the files removed and added to the device with the dates of alterations will be noted.

The investigators then took a tape of the CCTV footage to observe the actual entrances of the suspect into the office, the actions and the time that he was in the office and footage of the actions.

The network was also examined to determine the information that transacted through it during the said time span of the intellectual theft. This will include the analysis fall the information sent, the destinations of such information and the content of the emails sending the information and the persons who sent the information.

Findings

The investigators carried out forensic analysis on the several devices including the computer server, network, two laptops one belonging to the IT executive and the one belonging to the main suspect Mr. Dean Ambrose, external storage devices belonging to the Dean Ambrose. The investigation of the files was carried out by the use of systematic system procedure.

The investigation commenced on April 14 of 2017

The investigation concluded on 15th of may 2017.

After the investigators completed taking the available evidence. The analysis began taking place. The analysis of the forensic acquisition was given a priority whereby the forensic images of the said personal computer were put into thorough examination by the use of forensic tools. This analysis includes the analysis of fingerprints extracted from the computer surface to determine if the person seen in the CCTV footage was the said suspect.

The investigator applied the following tools and devices to conduct the investigation, given that these are certified devices for the forensic examination.

Microsoft Excel 2007

Internet Evidence Finder v3.3

SANS Investigative Forensic Toolkit (SIFT) Version 2.0

Guidance Software's Encase 6.17

Rewrapped by Harlan Carve

The network examination was conducted whereby the evidence was reviewed and by application of internet evidence finder, the investigators were able to uncover the evidence of information sent by the suspect to the competing company. The suspect, Mr. Dean Ambrose used his email and the Google drive to send the resent technological design to a competing company, The Big Buddy Commercial. The investigators realized that the suspect logged in to his computer connected to the company's network and he was able to send a number of files from his external hard drive to the said company. The evidence in the CCTV camera found to that Mr. Dean Ambrose gain access to Mr. Tom Hicks office on 5of April 2017 at 5.21pm where he spent 10 minutes in the office, whereby he was seen inserting a device to the computer USB port.

Forensic evidence indicated that the fingerprints matching M. Dean Ambrose were found on the surface of the computer belonging to Mr. Tom Hicks. These fingerprints were compared with the fingerprints of the suspect in the system and matching was found.

Conclusion

the conclusion of that the suspect., Mr. Dean Ambrose, I found liable for stealing crucial information from the company and trading them to a competing company hence jeopardizing the activity and existence of the company. Following the investigation by the internal investigators, the forensic evidence led to Mr. Dean Ambrose as the main suspect in the intellectual theft. The evidence found includes:

Possession of the intellectual material belonging to the company and stolen from Mr. Hicks personal computer.

He sent an email containing images and manuscripts of the latest designs made by the company to a competing company.

He entered the office of Mr. Tom Hicks and tampered with his personal computer.

This information will be present to the company board and the company's attorney to take action concerning the activities of Mr. Dean Ambrose.