ACC 693 Module 9 Milestone Three Example

Timeline of Events and Statement of Findings

[Student Name]

Southern New Hampshire University

ACC 693: Investigating with Computers

Milestone Three

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Timeline of Events and Statement of Findings

Introduction

The investigation has produced evidence from more than a dozen systems and records, each with its own dates. This milestone combines them into a single timeline, explains how dates and times were reconciled, states the findings that the timeline supports and quantifies the loss. Chabot et al. (2014) describe how forensic timelines built from many sources become reliable only when each event is linked to its source and the relationships between events are made explicit, and that principle guides the presentation.

Normalizing Time

Sources record time in different ways. The state business filing, the domain registration history and bank statements record dates only. Email headers and the cloud audit logs record universal time. Laptop artifacts record local time, and badge and VPN logs record Mountain Time from the company's servers. All times were converted to Mountain Time, adjusted for daylight saving, and the original value and zone were kept in the working file. The laptop's clock was compared with network logs for the same sessions and found to differ by under one minute.

Normalization changed the apparent order of two events. The draft invoice in entry 3 carries a universal-time header of 4:14 a.m. on March 2, which, read without conversion, would place it after the vendor request at 8:05 a.m. Mountain Time that day only by a few hours, and on the same date. Converted, it was sent at 9:14 p.m. on March 1, the evening before the request, which is the more telling sequence. Similarly, the VPN session in entry 14 begins at 11:52 p.m. local time but appears in the cloud audit log under June 28 in universal time. Recording both values prevents an opposing expert from presenting the conversion as an error. Casey (2011) warns that unexplained clock differences are a common basis for challenging digital timelines, so the comparison is documented.

The Timeline

Timeline of key events, Mountain Time

Findings

Finding 1. The subcontractor was formed and its domain registered in the four days before the vendor was set up, and the domain was registered with the project manager's personal email (entries 1, 2 and 4).

Finding 2. The project manager possessed a draft invoice for the subcontractor before the vendor existed in the company's records (entry 3).

Finding 3. All seventy-four invoices were created on his account and laptop from a template stored in his personal folder (entries 5, 7 and 9).

Finding 4. Forty-one invoice emails passed out through the company's own connection on days and hours when his badge had him on site (entry 7).

Finding 5. Daily logs, photographs and timesheets show the flashing work billed by the subcontractor was performed by the company's own crews, so no legitimate value was received.

Finding 6. Sixty-one percent of the money paid to the subcontractor was transferred to an account he holds jointly with his wife (entry 8).

Finding 7. Within eight hours of his interview, a wiping utility was run on his company laptop and his OneDrive folder was emptied, and five days later his personal phone was reset after a preservation letter (entries 13 to 15).

Quantifying the Loss

Payments to the subcontractor totaled $1,104,350 across seventy-four invoices on fourteen projects. Because Finding 5 shows the work was done by company employees who were paid through payroll, the subcontractor provided no value, and the full amount is the loss. Investigation costs, including the forensic firm's fees of about $86,000, are recoverable separately in the civil action but are not part of the fraud loss.

Loss by year

Limits

Thirty-three invoice emails came from residential addresses not yet attributed; a subpoena to the internet providers, available in the civil action, could identify the subscribers. The timeline shows what accounts and devices did, not who was at the keyboard, though badge records and the sequence of events make another user unlikely. Kent et al. (2006) recommend stating such limits with the findings, and they are carried into the final report. The timeline also omits routine events, such as each of the seventy-three later invoices, which are summarized in entry 7 and listed in full in the working file; the summary keeps the chronology readable without hiding any entry from a reviewer.

Conclusion

The timeline shows a scheme planned before the vendor existed, operated from the project manager's account and laptop for twenty-six months, funded by payments that reached his joint account and followed by an attempt to destroy evidence within hours of his interview. The loss is $1,104,350. The final project will present these findings in a report built for court.

References

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

Chabot, Y., Bertaux, A., Nicolle, C., & Kechadi, M.-T. (2014). A complete formalized knowledge representation model for advanced digital forensics timeline analysis. Digital Investigation, 11, S95-S105. https://doi.org/10.1016/j.diin.2014.05.009

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86