Last Written - This is the last time something was changed in the file and saved. This goes one level higher than the last accessed timestamp.

Transcription

1 From: Novak, Nathan J. Sent: Wednesday, December 10, :12 PM To: Paul A Lindvay; Williams, MaryD; Gloria Lamb Cc: Tellier, John; Daniel Garrie; Harrison, Stacy W.; Bill Walsh; Nolan J.Thompson Subject: RE: Evt files and Wiping Software Report In the interest of getting the report and this data provided to us today, we agree with Det. Lindvay s proposal to redact IMG 3619 through 3661 from his report, provided that Det. Lindvay believes that none of the website information contained therein relates to wiping or the use of wiping software. We reserve our rights on this matter, however. Regards, Nathan From: Paul A Lindvay [mailto:plindvay@azdps.gov] Sent: Wednesday, December 10, :42 AM To: Williams, MaryD; Gloria Lamb Cc: Tellier, John; Daniel Garrie; Harrison, Stacy W.; Novak, Nathan J.; Bill Walsh; Nolan J.Thompson Subject: Re: Evt files and Wiping Software Report In reference to the first 3 questions including subsections a,b,c, and d: Last Accessed - This is the last time the file was touched in some way. It could have been opened/executed by a user, it could have been opened/executed automatically by the system, or it could have been scanned/touched by another product such as an antivirus product. Last Written - This is the last time something was changed in the file and saved. This goes one level higher than the last accessed timestamp.

2 For example, the program Notepad is opened by the user. Notepad's last accessed timestamp will be updated. A text document from the hard drive is opened in Notepad. The last accessed timestamp for the document will be updated. Changes are made to the document on the screen in Notepad. No timestamps are updated. The changes made on the screen are saved using Notepad's save feature. The Last Written timestamp for the text document will be updated. A virus scan is later run on all files located on the computer. When the Notepad.exe file and the text document file are scanned, the last accessed timestamps will be updated to the time they were scanned. So, based off of the above scenario, No, the last accessed timestamp can not be reliably used to show user intervention, file execution, or anything else definitive. I have never stated that it was a reliable indicator. >>Again, from the Program listing Files, the Malware Bytes application Last Written time was 15:17. According to the malware bytes log you provided, the last log file was on 3:19 p.m. -- a few minutes from the last time it ran. Timestamps are a tricky thing. Different components get updated at different times. A two minute discrepancy is not note-worthy. Without testing a definitive answer can not be given as to why. A plausible answer is the Last Written timestamp was update for some reason when the application started and the log file was not written until the scan completed two minutes later. The log file timestamps would be considered a reliable indicator of when the application was executed (ballpark, not precise time). >> Relative to the CCleaner software, did that program actually run on August 3, 2013? See the answer provided above For questions 2 & 3 with regards to CCleaner, CCleaner does not keep any logs of what it does. I have already stated the last accessed time does not show that the application was actually executed at that time. X-Ways will automatically recover deleted data that it can "see" (not providing a tech answer for this). X-Ways was also told to recover data that it could find a "file header" for. This recovered data is not specific to CCleaner. I don't know for sure that CCleaner was ever run or did ever delete any data. The two recovery methods mentioned above were used for deleted data in general. I can not change this to be specific to CCleaner. >>Finally, with respect to the screen shot pictures, Mr. Walsh does object to those pictures being shared as many of them reference specific websites accessed and contain information from the desktop, that he should not be required to share with anyone. It seems like the screen shots are not relevant and that your report can stand alone

3 I object to the objection. The photos are absolutely necessary. The point of the exercise was to fully document the settings of the targeted programs. The photographs are the documentation. The photographs with website information are from the CCleaner "Cookies" tab. This tab shows the sites from which cookie files should be kept or deleted. Until you mentioned it, no one would have known who visited those sites or even if they were visited. I have no problem leaving these photos out (specifically IMG_3619 to IMG_3661) if Mr. Simms side agrees. This info should not be relevant to their case, but only they can make that determination. The rest of the photos do not show any type of user activity, only configuration info, and will be included. Please, let us get this issue resolved quickly so I can send this information out. Detective Paul Lindvay #5497 (CFCE, ACE, EnCE, GSEC, GCIH, A+, NET+, STORAGE+) Arizona Department of Public Safety Computer Forensics Unit Office: (602) Fax: (602) From: Williams, MaryD <MaryD.Williams@azag.gov> Sent: Wednesday, December 10, :36 AM To: Paul A Lindvay; Gloria Lamb Cc: Tellier, John; Daniel Garrie; Harrison Stacy W.; Novak Nathan J.; Bill Walsh; Nolan J.Thompson Subject: RE: Evt files and Wiping Software Report Detective Lindvay, Thank you for providing the report and information to the Department for its review. The Department has reviewed the report and pictures and requests clarification on a few points in your report prior to its distribution: 1. Based on the initial Macro Level Report Program Listing Files previously provided the Department noticed two things on Item 1: a. Most of the applications were Last Accessed between 18:05pm 18:19pm on 8/3/2014 (The last time Mr. Walsh turned on the machine before it was provided for imaging); b. The same thing on 8/6/ many applications were last accessed between 10:58am 10:59am (The time the Department s IT staff turned it on to ensure it was working before giving it to you); c. Mr. Walsh did not manually execute all those files on 8/3/2014 (i.e., AVG, Apple software update, BAE, Citrix) at 18:05. d. The Department s IT staff did not execute any applications (i.e., Adobe, Bonjour,

4 Broadcom, Canon, Corel, Dell, Google, Intuit, itunes, etc.) at 10:58 a.m. on 8/6/ Again, from the Program listing Files, the Malware Bytes application Last Written time was 15:17. According to the malware bytes log you provided, the last log file was on 3:19 p.m. -- a few minutes from the last time it ran. 3. Based on these findings, can you please define and explain the difference between Last Accessed and Last Written? The Department is wondering if Last Accessed time is really a reliable source to determine if an application was manually executed at all? The Department also has the following questions: 1. Relative to the CCleaner software, did that program actually run on August 3, 2013? 2. If so, can you determine if anything at all was deleted from the computer? 3. If so, could that information have been brought back when you did the examination? Finally, with respect to the screen shot pictures, Mr. Walsh does object to those pictures being shared as many of them reference specific websites accessed and contain information from the desktop, that he should not be required to share with anyone. It seems like the screen shots are not relevant and that your report can stand alone. Thank you. Mary ndvay [mailto:plindvay@azdps.gov] Sent: Tuesday, December 09, :53 AM To: Gloria Lamb Cc: Tellier, John; Daniel Garrie; Harrison Stacy W.; Novak Nathan J.; Williams, MaryD; Bill Walsh; Nolan J.Thompson Subject: Re: Evt files and Wiping Software Report I am ing the report to Mary Williams for the DOR side to review with a scaled down version of the pictures. She can forward the report as necessary to the required reviewing parties You can pickup the CD with the full size pictures when you come to pickup Mr. Walsh's computer and the portable hard drive. Detective Paul Lindvay #5497 (CFCE, ACE, EnCE, GSEC, GCIH, A+, NET+, STORAGE+) Arizona Department of Public Safety Computer Forensics Unit Office: (602) Fax: (602) From: Gloria Lamb <glamb@azracing.gov> Sent: Tuesday, December 9, :39 AM To: Paul A Lindvay

5 Cc: Daniel Garrie; Harrison Stacy W.; Novak Nathan J.; Williams, MaryD; Bill Walsh; Nolan J.Thompson Subject: RE: Evt files and Wiping Software Report Detective Lindvay, How are you wanting us to receive this CD? Do I pick it up or are you dropping It off here at our Main office? If I m picking it up, at what time? I am downtown right now. Gloria R. Lamb, MBA, MNCM IT Manager 1110 W. Washington St. Suite 260 Phoenix, AZ glamb@azracing.gov From: Paul A Lindvay [mailto:plindvay@azdps.gov] Sent: Tuesday, December 09, :05 AM To: Harrison Stacy W.; Novak Nathan J. Cc: John.Tellier@azag.gov; Gloria Lamb; Daniel Garrie Subject: Evt files and Wiping Software Report Despite the sent earlier today stating I would try to mail the CD containing the EVT files today, I am rescinding this statement. The wiping software report will be completed by the end of my work day. It contains over 100 photos whose size totals around 500 MB. The report will be provided to the Dept of Racing first as they have expressed concern that the report could contain personal info from Mr. Walsh and want to verify this is not the case. Being sensitive to privacy in general, this point is not up for debate. The report I will provide to the Dept of Racing will have scaled down versions of the pictures I will put on the CD. Once the Dept of Racing confirms the report contains no personal info, I will send the report with the scaled down images to Mr. Simms side. The report with the full sized images will be placed on the CD with the Event log files. It will then be mail. I would ask the Dept of Racing to be quick in their review of the report and let me know by the end of their day today that I can send the version to Mr. Simms side and mail the CD. Detective Paul Lindvay #5497 (CFCE, ACE, EnCE, GSEC, GCIH, A+, NET+, STORAGE+) Arizona Department of Public Safety Computer Forensics Unit

6 Office: (602) Fax: (602) NOTICE TO RECIPIENT This is meant for only the intended recipient of the transmission, and may be a communication privileged by law. If you received this in error, any review, use, dissemination, distribution, or copying of this is strictly prohibited. Please notify us immediately of the error by return and please delete this message from your system. Thank you in advance for your cooperation. For more information about Orrick, please visit