8/9/2019 Sample - Internal Investigation Report (1)
1/2
This sample report is from "Appendix: Resources" of the
Fundamental Computer Investigation Guide for Windows byMicrosoft
Corporation.
Sample - Internal Investigation ReportNorthwind Traders123 Main
WayRedmond, WAOctober 18, 2006
E aminer! "cott #$%& 'Technica% (ead, Northwind
Traders)*nterna% *n+esti ation Team! -ames .ine 'Technica%
"&ecia%ist, Northwind Traders), "&encer (ow'*T Mana er,
Northwind Traders), /an (i 'Technica% "&ecia%ist, #ontoso
(td)
Re $ester! Northwind TradersO ense! *nte%%ect$a% ro&erty The
t
CONCLUSIONThis in+esti ation conc%$ded that eter o$ston, "a%es
Mana er, Northwind Traders obtained$na$thori4ed access to
&ri+i%e ed i%es containin the inte%%ect$a% &ro&erty o
Northwind Tradersand trans erred them +ia e5mai% to an $na$thori4ed
third &arty
FINDINGSThe ana%ysis o the ser+er and %a&to&
com&$ter res$%ted in 17 i%es and 1 %o entries oe+identiary
interest .i%es were e amined $sin standard interna% in+esti ation
&roced$res
*n+esti ation started! "e&tember 1 , 2006 *n+esti ation
com&%eted! October 16, 2006 *n+esti ation ho$rs! 170 ho$rs
O&eratin systems e amined! Microso t9 Windows "er+er9 2003 R2,
Windows9 : " 2 .i%e system! NT." Amo$nt o data ana%y4ed! 1,200,000
M;
Evidence DescriptionItem 1: One *;M :5"eries 360 rac< ser+er,
"eria% N$mber 1115A1111511511151111
Actions ta
8/9/2019 Sample - Internal Investigation Report (1)
2/2
E+idence o$nd! The ser+er was accessed &hysica%%y and the
Acti+e =irectory9 directory ser+ice modi ied to
e%e+ate &ri+i%e e or acco$nt eter o$ston by assi nin the
acco$nt to the =omain Administrators ro$& on "e&tember 12,
2006 at 1>!07 The ser+er was interacti+e%y %o edon to as
nwtraders?Administrator at the time
=irectory =!? rod$ct =e+e%o&ment was ta!00 Ana%y4ed e+idence
co%%ected rom %a&to& *denti ied i%es ande+ents o interest
=oc$mented the system o%%owinstandard &roced$res
Additiona% in ormation! "ee attached #om&$ter E amination
Wor
