INVESTIGATION REPORTINFRINGEMENT CASE

1.YUSUPH KILEO 2. KABOYAONE

INVESTIGATION REPORT

TUTORIAL 3: COPYRIGHT INFRINGEMENT INVESTIGATION REPORT

1.1 SEARCH WARRANT

USA CITY COURT For the City Of New Mexico

In the Matter of the Search of Copyright Infringement Case No. 003

SEARCH WARRANT
To: Kaboyaone and Yusuph This is to certify and approve an application request by the forth stated duo, Kaboyaone and Yusuph in the search of Johns property herein his computer. The computer is believed to have anonymous information pertaining to the launched copyright infringement case.

The property to be searched is assumed to conceal the information pertaining to John and his actions during the course of his employment at MenBest Company (complaints).

The search or investigations that shall be conducted by Kaboyaone and Yusuph is expected to commence on or before the 19th of December 2011.

Issued to Kaboyaone and Yusuph, signature: ________________________ Date and time issued: _____________________ City and State: ______________________________________ Issuer signature: _____________________________________

INVESTIGATION REPORT

1.2 EXECUTIVE SUMARY

On 12th December 2011, it was brought to our attention to carry on the investigations relating to the suspicions of copyright infringement. The allegations arose due to another company called BadBoys giving several winter clothes to the market that the other company called MenBest claimed it was their future designs. The design called MenChris. From the retrieved evidences it can be proved that their newly employed IT assistant John has connections with the accused BadBoys. The retrieved evidences include the Chat log between two parties with no real names but one seems to be John and one member of BadBoys as they are discussing the goods. The email sent by John to BadBoys as well as the email acknowledgement together with the design attachments sent by John. It was also revealed from one of the evidences - chat log on how John might have got access to the companys future designs that were kept in Jullys account. John unlawfully cracked into Jullys account, got the companys future designs information and emailed it to BadBoys account together with the samples attached. As a result, John has been found guilty and will be charged according to the US copyright infringement law that states that, anyone who violates any of the exclusive rights of the copyright owner as provided by sections 106 through 122 or of the author as provided in section 106 A (a), or who imports copies or phonorecords into the United States in violation of section 602, is an infringer of the copyright or right of the author, as the case may be. For this incident, the Forensic Toolkit was used to help reveal all the possible evidences pertaining to the case.

INVESTIGATION REPORT

1.3 EVIDENCE IDENTIFICATION

The image from Johns computer was seized so as to further investigate him and his actions during the course of his stay as an employee of MenBest Company. John and his alleged customers/partners had set the deadline that John was working towards with the condition that every day he delays after the deadline there will be deductions from his share. The email conversations between John and BadBoys were revealed with the designs that he promised them from MenBest attached and guidelines on how to open the attachment. Below are the evidences descriptions as well as the snapshots identified from the seized image of Johns computer: Evidence ID Evidence 1.0 Description Chat log between 2 parties of whom it can be proved that one is a member of BadBoys APPENDIX A company and the other one is John from their topic of discussion. Evidence 2.0 The email sent by John to BadBoys that includes the design attachments, his bank account number APPENDIX B to deposit half of the payment, guidelines to open the attachment and the acknowledgement reply from the BadBoys that they have received and transferred payments. Evidence 3.0 Image attachments showing 3 of couture designs for winter show in Paris that John promised APPENDIX C designed by MenBest Evidence 4.0 Formal acknowledgement email sent to John using the name (Thief J.) that he referred himself APPENDIX D as on the chat log sincerely written from the BadBoys Evidence 5.0 Keylogger of Jullys account that John retrieved all the information from
3

Snapshots

APPENDIX E

INVESTIGATION REPORT

1.4 EVIDENCE COLLECTION

Having issued by an item that contained evidence - the image from Johns computer, the investigation team would precede to collecting the evidence. Conducting forensic investigations procedurally is aimed at acquiring accurate evidence. Therefore, investigators would ensure that the collected evidence is not tampered by presenting collected evidence in hash values both MD5 and SHA1.

Chain of Custody
Evidence Date/Time ID
Evidence 1.0 Wednesday, Dec 14, , 10:58:58 PM Evidence 2.0 Thursday, ec 15, , 3:15:52 PM Evidence 3.0 Thursday, Dec 15, , 11:07:06 AM Evidence 4.0 Monday, ec 12, , Kileo Kaboyaone Kileo Kaboyaone Kileo Kaboyaone Kileo Kaboyaone MD5 55e3179fca3952c8be9fe60469d0def6 SHA1 615ac66be406e89387ac3542a02d61f20e0e2 1ea MD5 55e3179fca3952c8be9fe60469d0def6 SHA1 615ac66be406e89387ac3542a02d61f20e0e2 1ea MD5 e6a9d458968ce2821906c0b68acef880 SHA1 68747aa9b3d94938371740642402eb83aed9 3204 MD5 e6a9d458968ce2821906c0b68acef880 SHA1 68747aa9b3d94938371740642402eb83aed9 3204 Evidence 5.0 Monday, ec 12, , Kileo Kaboyaone MD5 e6a9d458968ce2821906c0b68acef880 SHA1 68747aa9b3d94938371740642402eb83aed9 3204

Custodian

Witness

Hash Values

6:18:52 PM

3:15:52 PM

INVESTIGATION REPORT

1.5 EXAMINATION AND ANALYSIS

After collecting the evidence it has to be examined. This is where the subject computer would be examined; the prior identified evidence would be examined. These two stages entails filtering and breaking down any collected items, filter the evidence which means that the forensic investigators would remove any materials collected that are not useful to the case. The evidence would be classified into categories for easy reference, for example in a legal proceeding the evidence would be required and it would be easier if the investigation team categorized it.

Timeline analysis
Time 7th Dec 2011 11:25 HRS 7th Dec 2011 11:45 HRS 7th Dec 2011 11:52 HRS 7th Dec 2011 12:20 HRS Action Jullys account was cracked by John MenBest Copyright design was stolen from the company by John MenBest Design was collected from Jullys account by john The file that was taken from Jully was encrypted and zipped with password protection by John. 7th Dec 2011 13:10 HRS The file that Was encrypted and protected with password was sent to BadBoys in an attachment mail 7th Dec 2011 13:40 HRS The MenBest stolen Design Copyright was sent to BadBoys

INVESTIGATION REPORT

Functional analysis
LOCAL REMOTE

MEDIA

CD-R Probability 10

FLOPPY Probability 9

SW Internet

MOD EM proba bility 10

IMAGE

KEYBORD Probability 6

USER

USER SKILL

AUDIO Probability 1 CAMERA Probability 8 USB DRIVE Probability 10

USB

SPIKER

MEDIA 6

INVESTIGATION REPORT

Relational analysis

John Cracks Jullys Account 7th Dec 2011 1145HRS

MenBest Copyright design stolen by John 7th Dec 2011 1145HRS

7th

John collects the design from Jullys account and saves into a file 7th Dec 2011 1152HRS

John encrypts the file and zipped it with password protection 7th Dec 2011 1220HRS

John sends Zipped e-mail attachment to BadBoys 7thDec 2011 1320HRS

Zipped file contains Winter Clothing designs

John sends the copyright for MenBest design to BadBoys 7th Dec 2011 1340HRS

INVESTIGATION REPORT

1.6 RECONSTRACTION
Theinvestigative reconstruction leads to a more complete picture of a crime this is the phase where by the determination of what happened to the crime who committed the crime how and why the crime was committed is founded. This is also considered as a summary of the evidence analysis. In this case the Zipped file was encrypted and password protected which was then sent to BadBoys Company. The file contained some image with the format JNG and this image was the future design of MenBest winter clothing, MenChris. The evidence which contain image of the one of the Jacket called high visibility which is contained in the attached mail file; copyrights for the design were violated as it was stolen from the legitimate designer MenBest to BadBoys. John used Key logger to get Jullys account details which he then used the account details to crack into Jullys Account and still the designs of MenBest winter clothing and e-mail them to bad boys. The image of IPod jacket and the woolrichwwnn_2 crop were sent to BadBoys as stolen Designs from MenBest. All these evidences show that there were copyright infringements.

INVESTIGATION REPORT

APPENDIX A: CHART LOG

INVESTIGATION REPORT

APPENDIX B: EMAIL BETWEEN JOHN AND BADBOYS

10

INVESTIGATION REPORT

APPENDIX C: EMAIL ATTACHMENTS

11

INVESTIGATION REPORT

APPENDIX D: ACKNOWLEGMENT EMAIL FROM BADBOYS

APPENDIX E: KEYLOGGER

12