ACC 427 Module 8 Digital Forensics Assignment Example

One Computer, Four Clocks: Imaging a Scale-House Workstation and Reconstructing a Timeline

[Student Name]

Southern New Hampshire University

ACC 427: Investigating with Computers

Module Eight Assignment

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

One Computer, Four Clocks: Imaging a Scale-House Workstation and Reconstructing a Timeline

Introduction

The scale-house analytics, video and customer confirmations point to cash ticket voids made under one operator's user ID. The workstation at the scale-house counter is where those voids were entered, and it may hold evidence the scale vendor's records do not: who was logged into Windows, what other programs were open and whether anyone kept a private record of the skimmed amounts. This assignment plans the forensic examination of that computer and the construction of a timeline that joins it to the financial evidence, following the phases of collection, examination, analysis and reporting described in federal guidance (Kent et al., 2006).

Collection

The computer is company property, used only for scale operations and covered by the monitoring policy. On a Sunday when the landfill is closed, a certified forensic examiner, accompanied by the forensic accountant, photographs the workstation and screen, notes the system time against a reference clock and shuts the machine down. The examiner removes the drive, records its serial number and connects it to a forensic workstation through a hardware write blocker. The drive is then returned to the scale-house computer so operations can resume Monday, while the image is retained. Imaging on a closed day avoids alerting staff and avoids interrupting the scale, which cannot weigh trucks without the workstation. Each step is recorded in the chain of custody log.

Imaging and Verification

The examiner creates a bit-for-bit image of the entire drive, including unallocated space where deleted data may remain, and computes a hash value of the original drive and of the image. The values match, which proves the image is an exact copy. All analysis is performed on a working copy of the image. Casey (2011) emphasizes that this separation, never analyzing the original and always verifying the copy, is what allows an examiner to testify that findings reflect the evidence as collected.

What the Image Shows

The examiner recovered three kinds of evidence. Windows security logs record each interactive login, showing which Windows account was logged in at each time. The scale application keeps a local log on the workstation that mirrors the vendor's void records and adds the window that was active. And a spreadsheet, deleted 11 days before collection but recoverable from unallocated space, lists dates, truck plate numbers and dollar amounts. A comparison with the void data found that 1,031 of its 1,077 rows match voided cash tickets under Operator 3's user ID by date, plate and amount, a match rate that chance cannot explain.

Building the Timeline

The timeline merges four sources, each with its own clock: the workstation, the scale vendor's server, the bank's deposit records and the camera system. Clock differences were measured against the reference time noted at collection and confirmed by matching events that appear in two sources, such as a ticket printed at a known moment on camera.

Table 1. Clock Offsets Applied

Without the correction, camera footage would show trucks unloading seven minutes after the scale records them leaving, an apparent contradiction that a defense could exploit. With it, the sequence for a typical void is consistent: the ticket is printed, the customer pays and is seen on camera unloading, the truck leaves, and about 14 minutes after the sale the void is entered from the workstation while Operator 3's Windows account is logged in and, on the camera, he is the only person at the counter.

Linking the Spreadsheet to the Money

The recovered spreadsheet matters because it ties the workstation to the void pattern in a way no log can. Its 1,077 rows total $201,800; the 1,031 rows that match voided tickets total $194,600. The 46 rows without a matching void may be tickets voided under another reason code or entries for planned voids that did not happen; they will be reviewed with the vendor's data. Spreadsheet metadata show it was created two months after the first suspicious voids, last modified the day before the investigators' data request reached the vendor and deleted three days later. That sequence does not prove who deleted it, but it places the deletion within days of the investigation's first visible step, a fact counsel will want to put to the operator. The forensic accountant's analysis of the rows, comparing each to tickets, voids and video, is what turns a recovered file into evidence about the loss.

Limits and Principles

The image shows that the spreadsheet existed on the workstation and when it was created and deleted, and the logs show which accounts were active. They do not prove who typed the entries; on the days examined, video shows only Operator 3 at the counter during voids, which is strong corroboration. Garfinkel (2010) cautions that digital forensics faces growing data volumes and complexity, which makes documented, repeatable methods more important. Here every step, from collection to clock correction, is recorded so another examiner could reproduce it. The forensic accountant's role was to define the questions, interpret the financial meaning of the artifacts and integrate them with the analytics; the technical acquisition and recovery were performed by the certified examiner who will testify to them.

Conclusion

The scale-house workstation was imaged through a write blocker, verified by matching hash values and analyzed only as a copy. The image yielded login records, an application log and a deleted spreadsheet whose rows match 1,031 voided tickets. A timeline built from four sources, with a seven-minute camera correction, places the operator's account and, on video, the operator himself at the counter when voids were entered. The work follows documented forensic principles that support its later use, and every step can be repeated from the preserved image by an examiner retained by the other side.

References

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

Garfinkel, S. L. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7, S64-S73. https://doi.org/10.1016/j.diin.2010.05.009

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86