CLASSIFIED

OPERATION STOLEN CARDS

Digital Forensics Investigation Lab

Case #2024-CF-0847 | Lead: Det. Sarah Martinez

Investigation Progress

0 / 90 Points

Case Brief

On March 15, 2024, local law enforcement executed a search warrant at the residence of Jordan Blake following a joint investigation with the Secret Service into a credit card fraud ring. The investigation began after multiple victims reported fraudulent charges totaling over $75,000 across three states.

Suspect: Jordan Blake

Charge: Credit Card Fraud (18 U.S.C. § 1029)

Total Damages: $75,000+

Evidence Items: 2 Digital Devices

Your Mission: Analyze the seized digital evidence to identify and document criminal activity related to credit card fraud. Follow proper forensic procedures throughout the investigation.

📁

Evidence Items

Chain of Custody Required

💾

suspect_usb.img

Type: USB Flash Drive

Size: 512 MB

Label: "BACKUP_2024"

Location Found: Desk drawer

MD5: a1b2c3d4e5f67890abcdef1234567890

SHA256: 1234567890abcdef1234567890abcdef12345678

📱

mobile_device.img

Type: Samsung Galaxy (SM-G991U)

Size: 8 GB

Extraction Type: Physical

Location Found: On suspect's person

MD5: 9f8e7d6c5b4a32109876543210fedcba

SHA256: fedcba9876543210fedcba9876543210fedcba98

Evidence Acquisition & Verification

25 Points Total

Task 1.1: Create Working Copies

Pending 10 pts

Using the dd command, create forensically sound working copies of both evidence items.

Use dd to copy suspect_usb.img to usb_working_copy.img
Use dd to copy mobile_device.img to mobile_working_copy.img
Note: Copies will be saved in the directory forensics_case_0847

forensics@lab ~ /evidence

examiner@forensicslab:~$

💡 Hint: The basic dd syntax is: dd if=input_file of=output_file bs=block_size. Common block sizes are 4M or 1M.

Task 1.2: Generate Hash Values

Pending 8 pts

Calculate MD5 and SHA256 hash values for the original evidence files to establish chain of custody.

Calculate MD5 hash of suspect_usb.img
Calculate SHA256 hash of suspect_usb.img
Calculate MD5 hash of mobile_device.img
Calculate SHA256 hash of mobile_device.img

forensics@lab ~ /evidence

examiner@forensicslab:~$

💡 Hint: Use md5sum filename for MD5 hashes and sha256sum filename for SHA256 hashes.

Task 1.3: Verify Working Copy Integrity

Pending 7 pts

Verify that your working copies are exact duplicates by comparing hash values.

Calculate SHA256 hash for one of your working copy images
Compare the hash to the original evidence hash
Verify the copies are identical

forensics@lab ~ /forensics_case_0847

examiner@forensicslab:~/forensics_case_0847$

💡 Hint: Use sha256 to calculate the hash of a working copy file. The syntax is: sha256sum filename

USB Drive Analysis

30 Points Total

Task 2.1: Mount and Explore USB Image

Pending 8 pts

Mount the USB working copy and perform initial reconnaissance.

Mount the working copy image file to search for evidence.
Note: Be sure to use sudo when mounting sudo
Note: Be sure its read-only, and as its an img loop mount: -o ro,loop
Note: a mount directory is: usb_mount
List contents and identify file system type (use the List Contents buton to run the 'ls -la' command

forensics@lab ~ /forensics_case_0847

examiner@forensicslab:~/forensics_case_0847$

⚠️ Critical: Always mount forensic images READ-ONLY using the -o ro flag to prevent modifications!

Task 2.2: Identify Suspicious Files

Pending 7 pts

List all file in the mounted usb_mount to identify files relevant to credit card fraud.

forensics@lab ~ /forensics_case_0847/usb_mount

examiner@forensicslab:~/forensics_case_0847/usb_mount$

Task 2.3: File Carving for Deleted JPEGs

Pending 15 pts

Use file carving to recover deleted JPEG images that may contain photographs of stolen credit cards.

Use foremost to carve jpeg files
Carv from the usb working copy image
Use the output directory called carved_files
Examine recovered images for evidence

forensics@lab ~ /forensics_case_0847

examiner@forensicslab:~/forensics_case_0847$

💡 Hint: Foremost syntax: foremost -t jpeg -i image_file -o output_directory

Mobile Device Analysis

35 Points Total

Task 3.1: Extract Email Communications

Pending 12 pts

Extract and analyze email messages related to the fraud scheme.

Use strings to extract text from mobile image
Use strings to extract text from the mobile working copy image into a file extracted_text.txt
Search for email patterns using grep in the extracted_text.txt file.
Identify communications discussing credit cards

forensics@lab ~ /forensics_case_0847

examiner@forensicslab:~/forensics_case_0847$

💡 Hint: Use strings -a imagefile.img > outputfile.txt to create the textfile.
Use grep -i then "what to serch for" like "subject:" from the extracted_text.txt file.

Task 3.2: Extract Text Messages (SMS)

Pending 12 pts

Recover SMS conversations that may contain evidence of fraud conspiracy.

Use grep on the extracted_text.txt to search for lines with “sms” OR “message”

forensics@lab ~ /forensics_case_0847

examiner@forensicslab:~/forensics_case_0847$

💡 Hint: Search for SMS patterns with grep -i "sms\|message" or look for phone number patterns.

Task 3.3: Create Timeline of Communications

Pending 11 pts

Build a chronological timeline of key communications discovered in your investigation.

⚠️ Prerequisite: You must complete Tasks 3.1 and 3.2 before generating the timeline.

📅 Communication Timeline:

Date/Time	Type	Parties	Summary
2024-03-10 09:15	Email	J.Smith → J.Blake	Discussion of "new batch" with card numbers
2024-03-12 14:23	SMS	Unknown → J.Blake	Coordination of card exchange, pricing
2024-03-13 16:45	Email	M.Rodriguez → J.Blake	Payment confirmation for 50 cards
2024-03-14 09:15	SMS	M → J.Blake	Request for 30 additional cards
2024-03-14 18:32	SMS	Unknown → J.Blake	Meeting arrangement for transaction

Forensic Report

10 Points Total

Task 4.1: Prepare Professional Forensic Report

Pending 10 pts

Create a formal forensic examination report documenting your findings. Your report should be professional, thorough, and suitable for legal proceedings.

Load the report template. When done dowload the completed report text file then "Complete Lab" Take a screen shot of the Completed lab showing your score.

OPERATION STOLEN CARDS

Investigation Progress

Case Brief

Evidence Items

Evidence Acquisition & Verification

Task 1.1: Create Working Copies

Task 1.2: Generate Hash Values

Task 1.3: Verify Working Copy Integrity

USB Drive Analysis

Task 2.1: Mount and Explore USB Image

Task 2.2: Identify Suspicious Files

⚠️ Suspicious Files Discovered:

Task 2.3: File Carving for Deleted JPEGs

✓ File Carving Results:

Mobile Device Analysis

Task 3.1: Extract Email Communications

📧 Email Evidence Found:

Task 3.2: Extract Text Messages (SMS)

💬 SMS Evidence Found:

Task 3.3: Create Timeline of Communications

📅 Communication Timeline:

Forensic Report

Task 4.1: Prepare Professional Forensic Report

Case Information

Executive Summary

Methodology

Findings

Evidence Summary

Conclusions