CP Forensic Analysis PDF

DETAILS
Commonwealth vs. Michael Fiola

0701CR4736
PAGE 1 OF 30 PAGES
EXAMINATION REPORT
THIS IS A PRELIMINARY REPORT OF AN ONGOING FORENSICS ANALYSIS.

SUPPLEMENTAL REPORTS MAY FOLLOW AS THE EXAMINATION CONTINUES.
FACTS OF CASE
On November 20, 2006, Michael Fiola was issued a DIA laptop computer for the purpose of conducting his investigation
work in the field. The laptop was equipped with a Dell Broadband wireless card and Verizon wireless access.
On or about the beginning of March, 2007, according to John Glennons testimony, he reviewed the Verizon wireless bill
and noticed abnormally high data activity on Mr. Fiolas laptop. The data usage was four and a half times greater than
any of the other investigators which Mr. Glennon referred to as a red flag. Based on this information, Mr. Glennon
requested a review of the laptop by Andrew Stevens of the Information Technology department.
On March 13, 2007 at approximately 1:00 p.m., the laptop was removed from Mr. Fiolas possession and reviewed by
Mr. Stevens. Mr. Stevens found website files and images of child pornography in the temporary Internet files folder and
the laptop was turned over to the HR department. According to the testimony, an investigation was conducted by John
Glennon, David Olsen and Pam DeStefano wherein they established that the laptop was in Mr. Fiolas possession when
the child pornography appeared on the laptop computer. They presented the results of their investigation to Timothy
McMahon and Paul Buckley.
On March 14, 2007, a letter was authored by Paul Buckley informing Michael Fiola that his employment with the
Commonwealth of Massachusetts Department of Industrial Accidents is terminated effective immediately.
PURPOSE OF EXAMINATION
Determine if the evidence supports the allegations that Michael Fiola accessed pornographic material on the Internet
using his DIA issued laptop computer.
EVIDENCE EXAMINED
Item No
HDD01
Description
Fujitsu 80gb hard drive S/N: NW9HT6526LPH from
Dell Latitude D820 Laptop Computer Service Tag
8TTX5B1
Notes
Examination was performed on
EnCase evidence files
SUMMARY OF CONCLUSIONS
1.
There is no evidence to support the claim that Michael Fiola was responsible for any of the pornographic activity
found on the Dell laptop computer issued to him on November 20, 2006 by the Department of Industrial Accidents
(Laptop).
2.
There is no evidence to support any claim that Michael Fiola knew the pornographic material existed on the
Laptop.
TYPED EXAMINERS NAME
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 2 OF 30 PAGES
EXAMINATION REPORT
3.
There is conclusive evidence that the Laptop was infected with at least five serious viruses and Trojans that
caused the computer to be compromised for a period of at least four and a half months. The viruses and Trojans
positively identified on the Laptop are known for allowing attackers to access a computer remotely, steal
passwords and personal data; hijack Internet browsers; redirect web pages and Internet searches; generate
pornography; and download other malicious code.
4.
The evidence shows that the Symantec Corporate Edition antivirus protection software installed on the Laptop
was not functioning properly from the moment Michael Fiola received the Laptop, leaving the computer unsecured
and vulnerable to a variety of attacks.
5.
The evidence shows that the Systems Management Server software installed on the Laptop was configured
incorrectly and was not functioning properly from the moment Mr. Fiola received the laptop, leaving the computer
unmonitored and unmaintained.
EXAMINATION DETAILS
I added HDD01 evidence files to the case file in EnCase and ran the Initialize Case feature. I noted there was one hard
drive with two partitions. The C partition is created by Dell and is hidden to the user. The D partition, which would have
been shown as the C drive to the user, has a capacity of approximately 74.5gb, the time zone is set to Eastern Standard,
the operating system is Microsoft Windows XP and was installed on July 14, 2006 with the last proper shutdown on
March 14, 2007 at 8:34 a.m.
Volume C
File System:
Sectors per cluster:
Total Sectors:
Total Clusters:
Free Clusters:
Volume Name:
OEM Version:
Heads:
Unused Sectors:
Sectors Per FAT:
FAT16
4
112,392
28,034
24,108
DellUtility
Dell 8.0
255
63
110
Volume D
File System:
Sectors per cluster:
Total Sectors:
Total Clusters:
Free Clusters:
Volume Name:
Id:
Serial Number:
Full Serial Number:
Driver Information:
NTFS
Drive Type:
8
Bytes per sector:
156,183,930
Total Capacity:
19,522,991
Unallocated:
16,970,199
Allocated:
Volume Offset:
112,455
S-1-5-21-1736926318-1948651047-257121842
B0D5-25ED
5,670,266,366,026,130,925
NTFS 3.1
Drive Type:
Bytes per sector:
Total Capacity:
Unallocated:
Allocated:
Volume Offset:
Serial Number:
Sectors Per Track:
Number of FATs:
Boot Sectors:
Fixed
512
57,413,632 bytes (54.8MB)
49,373,184 bytes (47.1MB)
8,040,448 bytes (7.7MB)
63
07D6-0502
63
2
1
Fixed
512
79,966,171,136 bytes (74.5GB)
69,509,935,104 bytes (64.7GB)
10,456,236,032 bytes (9.7GB)
Time Zone Settings (minutes)

(GMT-05:00) Eastern Time (US & Canada)
Time Zone Bias:
Daylight Bias:
Standard Bias:
300
-60
0
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 3 OF 30 PAGES
EXAMINATION REPORT
Daylight start:
Standard start:
Sunday, Week 1 of Month 4, Hour 2

Sunday, Week 5 of Month 10, Hour 2
Product Name:
Current Version:
Registered Owner:
Registered Organization:
System Root:
Current Build Number:
Path Name:
Product ID:
Last Service Pack:
Product Key:
VersionNumber:
Source Path:
Install Date:
Last Shutdown Time:
Microsoft Windows XP
5.1
diauser
C:\WINDOWS
2600
C:\WINDOWS
76487-OEM-0011903-00102
Service Pack 2
C:\
07/14/06 10:15:41AM
03/14/07 08:34:03AM
According to the Dell Service Tag, the laptop was shipped on June 19, 2006 with an 80gb Fujitsu hard drive which is
consistent with the evidence examined.
Service Tag:
System Type:
Ship Date:
Dell IBU:
8TTX5B1
Latitude D820
6/19/2006
Americas
Quantity
Parts #
Part Description
1
1
1
U9625
DF771
XD736
DF266
GF470
FK812
1
1
TH984
CF265
D9330
NC293
CD516
GF120
NF964
NF965
UC172
PROCESSOR..., 80539, YONAH, T2400, 1.83, C0

CORD..., POWER..., 125, 1M, C7, 2P, DUAL..., UNITED STATES...
BATTERY..., PRIMARY..., 56W, 6C, LITHIUM..., SIMPLO
ASSEMBLY..., ADAPTER..., ALTERNATING CURRENT..., 90W, MOBILE 2007..., LEAD
FREE..., LITEON...
ASSEMBLY..., BASE (ASSEMBLY OR GROUP)..., INTEGRATED..., UNIFIED MEMORY
ARCHITECTURE..., D820
KIT..., SOFTWARE..., OVERPACK..., WXPPSP2C, COMPACT DISKETTE
W/DOCUMENTATION..., ENGLAND/ENGLISH...
HARD DRIVE..., 80G, Serial ATA..., 9, 54, FUJITSU..., M60+
MODEM..., WIRELESS..., DW5700, EVOLUTION DATAOPTIMIZED..., MINICARD...
ASSEMBLY..., COMPACT DISK DRIVE..., 24X, SMALL FORM FACTOR..., TEAC..., LEAD
FREE..., D MODULES...
CARD (CIRCUIT)..., NETWORK..., MINICARD..., 3945ULD, MOW1
LIQUID CRYSTAL DISPLAY..., 15.4WXGA, VIDEO ELEC. STDS. ASSOC....,
LENGTH/LONG...
ASSEMBLY..., CABLE..., COAXIAL ..., LIQUID CRYSTAL DISPLAY..., 15.4,
BREWSTER/COLOMBO...
BRACKET..., SUPPORT..., RIGHT..., METAL..., LIQUID CRYSTAL DISPLAY...,
BREWSTER/COLOMBO...
BRACKET..., SUPPORT..., LIGHT..., METAL..., LIQUID CRYSTAL DISPLAY...,
BREWSTER/COLOMBO...
KEYBOARD..., 87, UNITED STATES..., ENGLAND/ENGLISH..., DUAL POINTING...,
BLACK...
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 4 OF 30 PAGES
EXAMINATION REPORT
1
1
1
Y9530
JF155
HF932
DUAL IN-LINE MEMORY MODULE..., 1GB, 667, 128X64, 8K, 200

ASSEMBLY..., PALMREST..., TOUCHPAD..., STANDARD..., BREWSTER/COLOMBO...
CASE..., CARRYING..., NYLON..., BACK PACK..., NOTEBOOK..., TARGUS...
I reviewed and bookmarked the Folder Structure for installed applications, user-created files and folders.
I reviewed network and user account information and noted that the computer was identified as BOLIN17, connected to a
domain identified as DIA. The only local user accounts are those default accounts created by the Windows operating
system. The Administrator account was utilized from July 14, 2006 through March 14, 2007. In addition, there were
several Domain user accounts created for diauser, user, test, test2, michaelf and Administrator.DIA. The
Diauser folder was sent to the Recycle bin on 11/20/06 at 11:42 a.m. The folders for user accounts user, test and
test2 no longer appear in the folder structure but no information was found regarding their deletion.
Computer Account Name:
Primary Domain Name:
Name:
HostName:
LMHostFile
DefaultGateway:
PrimaryProvider:
DhcpIPAddress:
DhcpServer:
DhcpSubnetMask:
IPAddress:
IPAutoconfigAddress:
IPAutoconfigMask:
NameServergetInfo:
SubnetMask:
Lease Terminate Date:
Lease Obtained Date:
BOLIN17
DIA
1394 Net Adapter
User name:
Full Name:
Type of User:
Account Description:
Primary Group Number:
Security Identifier:
User belongs to group:
Logon Script:
Profile Path:
Last Logon:
Last Password Change:
Last Incorrect Password Logon:
Administrator
User name:
Full Name:
Type of User:
Logon Script:
Profile Path:
Last Logon:
Local User
Built-in account for administering the computer/domain
513
S-1-5-21-1736926318-1948651047-257121842-500
Administrators
D:\Documents and Settings\Administrator
03/14/07 06:32:47AM
07/14/06 08:15:00AM
03/13/07 11:26:45AM
diauser
Domain User
0
S-1-5-21-1736926318-1948651047-257121842-1005
D:\Documents and Settings\diauser
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 5 OF 30 PAGES
EXAMINATION REPORT
User name:
Full Name:
Type of User:
Logon Script:
Profile Path:
Last Logon:
User name:
Full Name:
Type of User:
Logon Script:
Profile Path:
Last Logon:
Username:
Full Name:
Type of User:
Logon Script:
Profile Path:
Last Logon:
User name:
Full Name:
Type of User:
Logon Script:
Profile Path:
Last Logon:
User name:
Full Name:
Type of User:
User belongs to group:
user
Domain User
0
S-1-5-21-1736926318-1948651047-257121842-1006
D:\Documents and Settings\user
test
Domain User
0
S-1-5-21-1736926318-1948651047-257121842-1007
D:\Documents and Settings\test
test2
Domain User
0
S-1-5-21-1736926318-1948651047-257121842-1008
D:\Documents and Settings\test2
michaelf
Domain User
0
S-1-5-21-2839713448-1943984298-1809027127-2004
D:\Documents and Settings\michaelf
administrator.DIA
Domain User
0
S-1-5-21-2839713448-1943984298-1809027127-500
Administrators
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 6 OF 30 PAGES
EXAMINATION REPORT
Logon Script:
Profile Path:
Last Logon:
D:\Documents and Settings\administrator.DIA
Using the Gallery view in EnCase, I reviewed all image files and bookmarked those images of a pornographic nature. All
of the pornographic images were found in one location on the computer, C:\Documents and Settings\michaelf\Local
Settings\Temporary Internet Files\Content.IE5. Also known as the Cache, this folder stores images, html pages,
cascading style sheets and java script files associated with web pages accessed using Microsofts Internet Explorer.
I sorted all files by create date and reviewed activity from November 20, 2006 through March 14, 2007. I bookmarked
relevant files and exported a complete File Listing including the file name, full path, physical size, file extension, date
created, last accessed and last written. I analyzed the computer activity on several dates in November, December,
January, February and March in an attempt to determine the origin of the pornographic activity and identify patterns.
November 20, 2006
The evidence shows the computer being setup for Mr. Fiola until approximately 3:35 in the afternoon with workrelated activity occurring in the evening.
21:02:21
21:20:18
21:28:17
22:49:36
23:02:39
Link file created to the 40 cent mile sheet

Vision Appraisal Technology website visited
Massachusetts Municipal Association website visited
Microsoft Word accessed
Fox News website accessed
END ACTIVITY
November 27, 2006

The evidence shows that the first significant user activity by Mr. Fiola after receiving the Laptop occurs on this
date. Child pornography appears in the temporary Internet files with no apparent origin or user interaction
preceding the pornographic activity. There were no website addresses typed into the browser, no searches
conducted, no other pages accessed that led to the pornography appearing on the Laptop. There are no
Symantec logs for this date.
10:39:31
Worcester website is accessed

END ACTIVITY
01:40:28
02:22:19
Restore point .ini files

smp[1].htm file appears, no page is visible but the html indicates the content is child
pornorgraphy; no searches or other Internet activity occur prior to this page.
The file sp[2]1.htm can not be viewed but it causes the browser to pop up even when being
accessed inside forensic software; this appears to be some sort of downloader Trojan.
popup.zaipal[1].htm can not be viewed and also pops up the browser from within the forensic
software indicative of the downloader Trojan.
KIDZINDEX1.htm appears this page could not be viewed but the underlying html language
02:22:20
02:22:21
02:24:02
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 7 OF 30 PAGES
EXAMINATION REPORT
02:24:03
shows its a child pornography site TOPKDS LOLITA BBS

sp[2] and popu.zaipal files appear again.
END ACTIVITY
December 6, 2006
The evidence reveals additional pornographic activity happening on this date with no apparent origin or user
interaction preceding the pornographic activity. There were no website addresses typed into the browser, no
searches conducted, no other pages accessed that led to the pornography appearing on the Laptop. There are
no Symantec Logs for this date.
07:27:57
13:31:28
14:04:44
14:48:58
Restore Point .que files

Load[1].htm is a website file that simply shows loading; unknown website or origin
Pornographic images appear with no origin and continue for approximately 44 minutes
Pornographic activity ends
END ACTIVITY
December, 7, 2006
searches conducted, no other pages accessed that led to the pornography appearing on the Laptop.
09:04:30
09:10:15
09:10:51
10:00:21
Websites accessed including weather and Worcester Works.com

script[1]1.js file appears; this is a JavaScript file containing various search engines including
foreign search engines and the term sun bbs; this JavaScript file appears to be related to a
virus or Trojan.
Symantec log begins reporting Adware.ZangoSearch and Downloader Trojan; 20
Instances reported
END ACTIVITY
12:37:36
12:43:48
12:46:30
12:51:44
12:53:10
13:13:40

4 desktop.ini files created
2 unknown htm files appear CAMXA327.htm and CAA99IRH.htm
Symantec log begins reporting Downloader Trojan; 5 instances
Pornographic images end
14:01:06
14:21:39
14:24:19
Restore point.que files

Pornographic images appear again with no origin and continue for approximately 30 minutes
index[8]8.htm file Preteen and Teen Models HQ Sites Collection also contains
downloader because page pops out of forensic software; several more downloaders appear
before activity ends
Symantec log begins reporting Downloader Trojan; 7 instances are reported
Symantec log reports Bloodhound.Exploit.95
09:12:42
14:43:27
14:43:38
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 8 OF 30 PAGES
EXAMINATION REPORT
14:44:10
14:47:44
14:50:21
Symantec log reports Trojan.ByteVerify

END ACTIVITY
December 11, 2006

no Symantec logs for this date.
11:36:52
13:59:08
14:13:08
14:13:18
14:13:21
14:15:24
14:48:58
14:48:58
14:49:02
14:54:12
Restore Point .que file

GGGD.tmp
Googletoolbardownloader_EN prefetch file
GGGD.tmp prefetch file
Two unknown html files appear CA65EDMT.htm and CAQZ0DIR.htm; pornographic images
appear and continue for approximately 30 minutes
edw.exe-0f1df43f.pf file
Sweet-young.htm file appears this file popped out of the forensic software and caused my
forensic computer to freeze and I had to shutdown and reboot this is the end of pornographic
activity for this date.
Dr. Watson is loaded indicating problem with the computer
END ACTIVITY
December 21, 2006

09:37:11
10:52:09
12:53:54
13:33:59
13:44:00
13:52:13
14:28:42
14:32:15
14:51:53
Gmail accessed
Shrewsbury and City of Malden websites visited
wifilocator.exe prefetch file
Restore Point.que files
Pornographic images appear with no origin and continue for approximately one hour; sites
include lolitas, urinelove and scat sites
Restore Point.que file
desktop.ini files
END ACTIVITY
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 9 OF 30 PAGES
EXAMINATION REPORT
December 27, 2006
11:18:28
11:29:25
11:29:53
11:30:09
11:31:31
11:33:53
12:04:00
14:01:52
14:16:53
14:25:56
14:35:01
14:37:36
14:38:16
14:41:45
15:08:15
Spencer Mass website

Unknown htm files appear CAG5EF8H.htm, CA2FPRK2.htm, CALNOAJ9.htm, CAYXDTID.htm
Pornography images begin appearing with no origin
Pornographic images appear from scat site
Ert.jar zip file ACTIVITY ENDS
Windows Media Player prefetch file
Pornographic images appear with no origin
taboomoviej10-3 prefectch file
Pornographic images appear with no origin and continue for approximately 30 minutes; sites are
scat and urine
END ACTIVITY
January 6, 2007
14:11:25
14:14:17
14:19:02
14:38:21
15:08:03
15:22:25
15:22:48
15:34:50
15:39:46
15:59:47

SMS.exe prefetch file
Begin Internet activity related to real estate
End Internet activity related to real estate
Symantec log reports Drivecleaner
index[8].htm Nymphets web page appears
Symantec log begins reporting Downloader Trojan; 14 instances reported
index[1]1.htm Little Nymphets webpage (page pops out of FTK indicating it is a downloader)
END ACTIVITY
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 10 OF 30 PAGES
EXAMINATION REPORT
January 10, 2007
09:20:17
09:42:21
10:24:36
11:51:11
12:08:24
12:16:43
12:19:30
12:35:11
14:26:47
14:36:44
14:50:03
14:50:31
14:54:51

Windows Media Player prefetch file
Taboomovie9tr0-1 MPEG prefetch file
rundll32.exe prefetch file
Symantec log reports Trojan.ByteVerify; 3 instances reported
END ACTIVITY
January 11, 2007

09:52:06
09:53:01
10:30:24
10:58:11
11:03:12
11:09:31
11:10:04

Pornographic images appear with no origin and continue to appear sporadically for
approximately one and a half hours
Symantec log reports Downloader Trojan; 24 instances reported
February 8, 2007
searches conducted, no other pages accessed that led to the pornography appearing on the Laptop. In addition,
the activity happens at a high rate of speed.
12:12:15
12:14:26
12:15:13
Gmail
Vision Appraisal website
Massachusetts Tax Assessors website
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 11 OF 30 PAGES
EXAMINATION REPORT
12:17:35
12:19:05
12:20:41
12:22:16
12:44:00
12:54:10
12:56:00
13:03:31
13:27:42
13:54:43
14:02:09
14:07:45
15:09:11

City of Brockton Assessors website
Symantec VBN log reports Downloader Trojan
Multiple html pages appear with no content and Service Temporarily Unavailable this is
indicative of the Feebs Family virus; web pages are being created at the rate of 20-40 per minute
Symantec log reports downloader
Nymphets website appears and activity ends
Sovereign Bank website
Sovereign Bank website
Pornographic images appear with no origin and continue for approximately one hour
END ACTIVITY
February 14, 2007

The evidence reveals additional pornographic activity happening on this date. Several search results screens
appear on this date with the term bbs and tpg.
09:38:00
09:38:50
09:39:31
09:45:34
10:44:58
10:45:07
10:53:10
11:01:01
11:05:22
11:05:41
11:05:56
11:15:11
Website for Massachusetts Government

Gmail
Careerbuilder.com
Website for Acushnet, MA
login to CMS
login to CMS
login to CMS
Gmail
Google search results page nymphey bbs
Bleso.com website pornography images appear and continue for 10 minutes
Drivecleaner
Google search results page nymphets bbs
END ACTIVITY
12:32:45
12:33:40
12:35:40
12:39:54
12:40:22
12:40:53
12:40:58
12:41:28
12:43:29
12:43:45
12:44:30

Gmail
Google search page appears nymphets tpg
Google search page appears - nymphets tpg
Google search page appears nymphets tpg
login to CMS
login to CMS
Website appears best rape sites
MSN search page appears - sun Lolita BBS
Drivecleaner
barelylegal[1].htm
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 12 OF 30 PAGES
EXAMINATION REPORT
12:44:34
12:45:11
12:45:17
12:45:43
12:45:47
12:45:54
12:47:07
12:48:29
13:16:30
13:23:44
13:24:55
13:25:34
13:30:46
13:39:24
13:41:34
13:41:50
13:41:57
13:58:59
13:59:04
13:59:17
13:59:44
14:02:58
14:03:47
14:06:42
14:07:52
14:08:06
14:12:13
14:12:51
14:15:24
14:15:49
14:17:11
14:37:11
14:38:41
14:38:42
preview[1].htm
gallery1[1]1.htm
gallery1[1].htm
login to CMS
movie1[1].htm
Search page appears - 12 year old model bbs
Google search page appears - non nude pre teen sites
fetishcon[1].htm beginning of scat websites
Symantec reports Downloader Trojan
Scat pornography ends
login to CMS
login to CMS
restore point activity
login to CMS
login to CMS
login to CMS
Google search page appears preteen nonnude
Google search page appears preteen non nude
guestbook[1].htm Combat BBS popped up browser indicative of the downloader Trojan
myinceststories.htm
index[1]3.htm drivecleaner
search[2]2.htm Google search preteen incest storys
search[1]15.htm Google search preteen incest stories
search[6]7.htm Google search pedophile fiction incest stories results 1-10
search[7]4.htm Google search pedophile fiction incest stories results 41-50
installdrivecleanerstart[1].ext
[2].htm drivecleaner
search[1]7.htm Google search free incest pictures results 81-90
search[7]1.htm Google search incest taboo results 1-10
incest[1].htm incest website pops FTK like a downloader
porn activity ends
VNB file shows Trojan.ByteVerify
END ACTIVITY
19:36:54
19:42:03
19:45:21
19:46:03
19:52:11
19:54:43
19:56:06
VBN finds downloader

search[4]4.htm Google search for cartography
out[5].htm www.innocent-youth.com/angel-teens top
nymphets_land_gallery_3[1].htm
porn ends
Symantec services shuts down system shut down
END ACTIVITY
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 13 OF 30 PAGES
EXAMINATION REPORT
March 8, 2007
The evidence reveals additional pornographic activity happening on this date with no apparent user interaction
preceding the pornographic activity. Additional search results screens appear on this date with unusual search
engines.
11:50:58
11:55:28
11:58:21
11:59:47
12:00:46
12:37:59
12:38:06
12:38:13
12:38:14
12:38:25
13:02:13
13:02:27
13:07:48
13:07:55
13:20:49
13:21:02
13:21:56
13:25:40
13:28:20
13:29:53
13:31:22
13:34:28
13:34:31
13:38:37
13:41:27
14:17:24
14:17:42
14:18:22
14:39:10
15:27:21
Real Estate websites

Best Candid.com website School girls and child models
Preteen-Preteen.com search page preteen models
7[2]1.htm requested URL/bng/7.jpg was not found on this server pornographic images
continue for approximately 40 minutes
Coolnetsearching.info search results code help myspace
Coolnetsearching.info search results help desk services
Looksearch home page
CA67EN2D.htm page appears
Forbidden Lolitas Pictures website
Login to CMS
Login to CMS
Login to CMS
Login to CMS
Google search results pet show in ri
Google search results ri convention center
Google search results dunkin donuts center ri
7[3]1.htm The requested URL /bng/7.jpg was not found on this server
Japanese pornography website pops out of FTK indicative of Downloader Trojan
7[1]12.htm The requested URL /bng/7.jpg was not found on this server
Best Pay Lolita Porn Sites
ToseekA.com search results social studies activities
ToseekA.com search results what is divorce
Lolita Gallery website
big[2]1.htm The requested URL / new/classic-cpinfo/thumbs/big.jpg was not found on this
server pornographic images continue for approximately 30 minutes
Netster home page
Coolnetsearching.info search results spyware removal tool
Google search results nymphets
Spiritair website
END ACTIVITY
I ran the link file parser and bookmarked all Link Files. Link files are shortcuts to other files that contain only the location
of another file. On March 13, 2007 from approximately 1:15 p.m. to 2:28 p.m., several link files were created under the
Administrator account Recent folder including a Word document and several image files in the temporary Internet files
folder.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 14 OF 30 PAGES
EXAMINATION REPORT
Link File Path:

Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administrator\Desktop\Shortcut to Content.IE5.lnk
Link File:
Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administrator\Desktop\Shortcut to Content.IE5.lnk
Link File Offset:
0
Link File Size:
944
Created Date:
11/20/06 03:05:26PM
Last Written Date:
12/07/06 12:43:48PM
Last Accessed Date:
03/13/07 01:15:59PM
Volume Label:
C
Base Path:
C:\Documents and Settings\michaelf\Local Settings\Temporary Internet Files\Content.IE5
----------------------------------------------------------------------------Documents and Settings@1l6michaelf(t5- m6i michaelfL1
1LOCALS~14t5 m6i Local Settingszl6e TEMPOR~1H
t5 m6 Temporary Internet Files{v I3b
5y Content.IE5.t5 m6 Content.IE5{v I3
-%C:\Documents and Settings\michaelf\Local Settings\
Temporary Internet Files\Content.IE5B..\..\michaelf\Local Setting
s\Temporary Internet Files\Content.IE5` Xboli
n17Mp Irn eFMp Irn eF
Link File Path:
Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administrator\Recent\Doc1.doc.lnk
Link File:
Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administr ator\Recent\Doc1.doc.lnk
Link File Offset:
0
Link File Size:
483
Created Date:
03/13/07 02:04:23PM
Last Written Date:
03/13/07 02:06:23PM
Last Accessed Date:
03/13/07 02:06:23PM
Volume Label:
C
Base Path:
C:\Documents and Settings\Administrator\Desktop\Doc1.doc
Working Directory:
C:\Documents and Settings\Administrator\Desktop
----------------------------------------------------------------------------C:\Documents and Settings\Administrator\Desktop\Doc1.doc..\Desktop\Doc1.doc/
C:\Documents and Settings\Administrator\Desktop`
Xbolin17Mp IrzFMp IrzF
Link File Path:

Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administrator\Recent\6[2].jpg.lnk
Link File:
Fiola\2007-034-3699-0070-HDD1\D\Documents and Settings\Administr ator\Recent\6[2].jpg.lnk
Link File Offset:
0
Link File Size:
1346
Created Date:
02/14/07 08:36:32PM
Last Written Date:
02/14/07 08:36:32PM
Last Accessed Date:
03/13/07 02:28:09PM
Volume Label:
C
Base Path:
C:\Documents and Settings\michaelf\Local Settings\Temporary Internet Files\Content.IE5\0LUJC5A7\6[2].jpg
Working Directory:
C:\Documents and Settings\michaelf\Local Settings\Temporary Internet Files\Content.IE5\0LUJC5A7
----------------------------------------------------------------------------DOCUME~1D1m6i Documents and Settings@1l6m
ichaelf(t5- m6i michaelfL11LOCALS~14t5 m6i Lo
cal Settingszl6e TEMPOR~1Ht5 m6 Temporary In
ternet Files{v I3b5y Content.IE5.t5 m6
Content.IE5{v I3Zm6f 0LUJC5A7(5m6
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 15 OF 30 PAGES
EXAMINATION REPORT
0LUJC5A7{v I3B2.O6 6_2_~1.JPG(O6m6%

6[2].jpg-%C:\Documents and Settings\mi
chaelf\Local Settings\Temporary Internet Files\Content.IE5\0LUJC5A7\6[2].jpgT..\..\mi
chaelf\Local Settings\Temporary Internet Files\C
ontent.IE5\0LUJC5A7\6[2].jpg_C:\Documents and Se
ttings\michaelf\Local Settings\Temporary Interne
t Files\Content.IE5\0LUJC5A7` Xbolin17Mp I
rzFMp IrzF
I reviewed the INFO2 records and bookmarked relevant information. Windows utilizes a repository for deleted files called
the Recycle Bin. The existence of the Recycle Bin allows a user to retrieve a document previously deleted. In order for
Windows to delete a file in this manner, certain information must be stored in records so that the original information
about the file may be restored, such as the file name. The file containing this information is named INFO2 and resides in
the Recycle bin directory. The only data sent to the Recycle Bin between February 5, 2007 and March 12, 2007 is the
folder rock.est.
Name
Full Path
File Created
Last Accessed
Last Written
File Deleted
Is Deleted
Index
1
2
3
4
5
6
7
8
9
10
11
12
13
INFO2
Fiola\2007-034-3699-0070-HDD1\D\RECYCLER\S-1-5-21-2839713448-1943984298-1809027127-2004\INFO2
11/20/06 03:34:55PM
03/12/07 01:19:05PM
03/12/07 01:19:05PM
Deleted
Path
02/05/07 03:03:37PM
02/07/07 12:52:04PM
02/08/07 02:30:15PM
02/14/07 07:24:54AM
02/14/07 02:38:16PM
02/15/07 03:11:50PM
02/20/07 03:08:42PM
02/21/07 02:21:06PM
02/28/07 01:06:04PM
03/05/07 01:59:22PM
03/07/07 12:48:12PM
03/08/07 02:40:34PM
03/12/07 12:34:39PM
C:\Documents and Settings\michaelf\Desktop\rock.est

I reviewed the registry files for SOFTWARE, SAM, SYSTEM AND NTUSER.DAT and bookmarked relevant information.
The Windows registry is a directory which stores settings and options for the Windows operating system. It contains
information and settings for the hardware, operating system software, most non-operating system software, users,
preferences, etc.
The registry entry that contains information for all Internet website addresses typed by the user michaelf is empty.
Software\Microsoft\Internet Explorer\TypedURLs
Last Written Time 3/12/2007 18:17:44 UTC
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 16 OF 30 PAGES
EXAMINATION REPORT
Name
Type
Data
(default) REG_TYPE_SZ (value not set)

The registry entry that contains information for files in the Recent folder for user michaelf revealed only work-related
documents.
Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Name
Type
Data
MRUListEx REG_BINARY MRU ordered list : 3, 2, 1, 0

3
Shortcut Target Name

: rock.est
REG_BINARY Shortcut Name (ASCII) : rock.est.lnk
Shortcut Name (Unicode) : rock.est.lnk

: 40 cent mile sheet(1).xls
REG_BINARY Shortcut Name (ASCII) : 40 cent mile sheet(1).xls.lnk
Shortcut Name (Unicode) : 40 cent mile sheet(1).xls.lnk

: Daily_Sept_06(1).xls
REG_BINARY Shortcut Name (ASCII) : Daily_Sept_06(1).xls.lnk
Shortcut Name (Unicode) : Daily_Sept_06(1).xls.lnk

: copyprotection.bmp
REG_BINARY Shortcut Name (ASCII) : copyprotection.bmp.lnk
Shortcut Name (Unicode) : copyprotection.bmp.lnk
The registry entries that contain information for files that have been opened and/or saved by user michaelf revealed
only work-related documents.
Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*
Class Name
Name
Type
Shell
Data
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 17 OF 30 PAGES
EXAMINATION REPORT
MRUList REG_SZ bdca
b
REG_SZ C:\Documents and Settings\michaelf\Desktop\rock.est
REG_SZ C:\Documents and Settings\michaelf\My Documents\rock.est
REG_SZ C:\Documents and Settings\michaelf\Desktop\rorck.est
REG_SZ C:\Documents and Settings\michaelf\Desktop\copyprotection.bmp
Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
Class Name
Name
Shell
Type
Data
MRUList REG_SZ
ba
REG_BINARY
53 00 74 00 72 00 65 00 65 00 74 00 73 00 2E 00 65 00 78 00 65 00 00 00
43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00
20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00
73 00 5C 00 6D 00 69 00 63 00 68 00 61 00 65 00 6C 00 66 00 5C 00 44 00
65 00 73 00 6B 00 74 00 6F 00 70 00 00 00
(ASCII String)
S.t.r.e.e.t.s...e.x.e...C.:.\.D.o.c.u.m.e.n.t.s. .a.n.d.
.S.e.t.t.i.n.g.s.\.m.i.c.h.a.e.l.f.\.D.e.s.k.t.o.p...
(UTF-16 String) Streets.exe
REG_BINARY
6D 00 73 00 70 00 61 00 69 00 6E 00 74 00 2E 00 65 00 78 00 65 00 00 00
43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00
20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00
73 00 5C 00 6D 00 69 00 63 00 68 00 61 00 65 00 6C 00 66 00 5C 00 44 00
65 00 73 00 6B 00 74 00 6F 00 70 00 00 00
(ASCII String)
m.s.p.a.i.n.t...e.x.e...C.:.\.D.o.c.u.m.e.n.t.s. .a.n.d.
.S.e.t.t.i.n.g.s.\.m.i.c.h.a.e.l.f.\.D.e.s.k.t.o.p...
(UTF-16 String) mspaint.exe
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 18 OF 30 PAGES
EXAMINATION REPORT
The registry entry that contains information regarding the Firewall settings for the Laptop indicate that the Windows
firewall was turned off on July 14, 2006 and remained turned off.
ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Name
Type
EnableFirewall REG_DWORD
time_t (Stored)
Data
0x00000000 (0)
Thu Jan 01 00:00:00 1970
time_t (As Local) Wed Dec 31 17:00:00 1969

DOS date/time
- 12:00:00 AM
ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Name
Type
EnableFirewall REG_DWORD
time_t (Stored)
Data
0x00000000 (0)
Thu Jan 01 00:00:00 1970
time_t (As Local) Wed Dec 31 17:00:00 1969

DOS date/time
- 12:00:00 AM
The executable file shellep.exe en was found under Software\Microsoft\Windows\Current Version\Run. Files in this
location of the registry will execute when the computer is turned on. This file was written to the registry on January 10,
2007. Shellexp.exe, also known as Bkdr_Sheldor.B and Adware.Sheldor, has been identified as a backdoor/Trojan that
deletes cookies from the temporary Internet files, monitors newly created cookies, and redirects searches to
Adware.Sheldors search site based upon keywords that trigger advertisements for adult websites. Some of the
innocuous keywords that trigger this pornographic activity are: diet, DVD, health, horoscope, insurance, jobs, loan,
mortgage, phone, spyware, travel, etc. For more detailed information regarding this file, click here.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 19 OF 30 PAGES
EXAMINATION REPORT
Software\Microsoft\Windows\CurrentVersion\Run
Name
Type
Data
Explorer REG_SZ C:\WINDOWS\system32\shellexp.exe en

I reviewed the Index.dat files and created a report of activity. Index.dat is a file used by the Internet Explorer web
browser that functions as a repository of redundant information such as web URLs, search queries and recently opened
files.
I reviewed all log files and bookmarked relevant activity. Log files are files automatically created by software applications
to record activity and information not explicitly provided by the user.
The Symantec Corporate Edition antivirus software that was installed on the Laptop maintains several different types of
log files. A log file identified by the month, day and year followed by .log (ie: 01012007.log) is created for each date
that the Symantec services are turned on and off which should coincide with each day the Laptop is being used. The
information recorded within the log file includes the date and time of the activity using a Hex value, the computer name,
the user name, the nature of the activity, the name of any infection found, the file path for the infected file, the action
taken, the IP address, etc. Also included in the log file is activity regarding virus definition files, virus scans and malware
detection. Log files for October through March were located on the Laptop and reviewed.
October, 2006
Two log files were found for October, 10042006.log and 10052006.log with recorded activity for October 4th
and October 5th. The computer name reported in the log is BOLLE04 indicating that the Laptop was previously
named BOLLE04 prior to being named BOLIN17. The user name is Administrator indicating that the
Administrator was logged into the computer at the time the activity was recorded. The log file indicates a scan
was run and completed on selected files and folders totaling 338 files. To view both October logs with the date
codes converted from their Hex values, click here.
November, 2006
Only one log file was found for November, 11222006.log with recorded activity for November 22, 2006. The
computer name reported in the log is BOLIN17 and the user is michaelf. The log indicates that a scan was
started on selected files and folders at 10:36 a.m. and the IP address is 198.203.237.151. However, there is no
entry indicating that the scan completed or was canceled. This IP address is one of the pubic IP addresses
owned by DIA and indicates that the computer was physically connected to the DIA network at the time the scan
was run. Since the Laptop was not given to Michael Fiola until after 3:00 p.m. on 11/22/06, this log indicates that
the computer was in the hands of the IT department at the time of the activity. Although the evidence shows user
activity on several additional days in November, no Symantec logs exist for these dates indicating that the
Symantec software was not functioning correctly. To view the November log with the date codes converted from
their Hex values, click here.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 20 OF 30 PAGES
EXAMINATION REPORT
December, 2006
Only one log was found for December 12072006.log with recorded activity for December 7, 2006. There are no
log entries indicative of a virus scan being performed. The log file reports Adware.Zango Search, Downloader
Trojans, Bloodhound.Exploit.95 and Trojan.ByteVerify attacking the system on December 7th from 9:12:42
through 14:44:10. Although the evidence shows user activity throughout the month of December, other than
December 7th, no other log files exist indicating that Symantec was not functioning properly. To view the
December log with the date codes converted from their Hex values, click here.
January, 2007
Log files were found for January 3, 4, 6, 10, 11, 17 and 18. (01032007, 01042007, 01062007, 01102007,
01112007, 01172007, 01182007). A log file was found for January 29th, however, the file was corrupted and
unreadable. The only virus scan recorded for the month of January was found in the log file for January 3rd. The
scan started at 10:40:50 and completed at 10:41:09 for a total of approximately 19 seconds and scanned 350
files. There were over 108,000 files on the Laptop and a thorough virus scan would have required at least 30
minutes to complete. This information is an indication that the Symantec software is not configured and/or
functioning properly. The remaining logs for January show viruses and Trojans attacking the Laptop including the
Downloader, Downloader.Trojan, Drivecleaner and Trojan.ByteVerify. To view all January logs with the date
codes converted from their Hex values, click here.
February, 2007
Log files were found for February 2, 5, 7, 8, 12, 14, 15, 20, 21 and 28 (02022007, 02052007, 02072007,
02082007, 02122007, 02142007, 02152007, 02202007, 02212007, and 02282007). The log file for
February 2, 2006 recorded a virus scan started at 07:30:55 and completed at 07:31:23 for a total of approximately
28 seconds and scanned 348 files. This was the only scan recorded for the month of February and indicates that
the Symantec software was still configured incorrectly and/or malfunctioning. The remaining logs for February
show viruses and Trojans attacking the Laptop including the Downloader, Downloader.Trojan and
Trojan.ByteVerify. To view all February logs with the date codes converted from their Hex values, click here.
March, 2007
Log files were found for March 2, 5, 7, 8, 12, 13 and 14 ( 03022007, 03052007, 03072007, 0308007,
03122007, 03132007, and 03142007). The log file for March 2, 2007 recorded a virus scan started at
07:18:48 but the scan was canceled one minute later at 07:19:49. The partial scan indicated that it scanned 7106
files prior to being canceled. At 07:27:34 the scan was started again and completed at 07:28:32 with 400 files
scanned. This was the only scan recorded for the month of March. The remaining logs for March show viruses
and Trojans attacking the Laptop including the Downloader, Bloodhound.Exploit.20 and Trojan.ByteVerify. To
view all March logs with the date codes converted from their Hex values, click here.
The Microsoft Systems Management Server software (SMS) was installed on the Laptop and is used to monitor and
maintain client computers including the installation of security patches and software updates; detection of vulnerabilities;
remotely troubleshooting problems; etc. The SMS software maintains a variety of logs that provide details about a
components activity and state. A review of the SMS Log Files revealed an inordinate number of errors beginning
November 20, 2006.
I mounted the evidence files as drives F: and G: using Mount Image Pro Version 2.44. Using Avast Version 4.7 and
current virus definition files, I scanned drives F: and G: and found 25 infections. Using Norton Anti Virus 2008 with
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 21 OF 30 PAGES
EXAMINATION REPORT
current virus definition files, I scanned drives F: and G: again and found additional infections. The following describes
the infections that were found on the Laptop as of the date it was forensically imaged.
Downloader
Downloader connects to the Internet and downloads other Trojan horses or components. This Trojan is a Windows Metafile (WMF) image file
that is specially crafted to take advantage of a Windows vulnerability. This vulnerability is a zero-day exploit that is capable of remote code
execution. Zero-day exploits are termed as such because the unpatched vulnerability and its corresponding exploit code are released within
the same day. This may pose as a dangerous situation in which a lot of computers may be affected due to the availability of exploit code, and
the fact that the vendor has not been given enough time to patch it. Once exploited successfully, the said vulnerability allows this Trojan to
connect to a certain Web site. It is possible that this Trojan may download possibly malicious files from the said site, which may further
expose the affected system to malicious threats.
DriveCleaner
DriveCleaner is a rogue application distributed through aggressive pop ups, typically after multiple infections. The misleading application can
be manually downloaded and installed, or it may be installed by a downloader, without the user's consent.
Feebs Family
This malicious JavaScript is usually embedded in a malicious Web site. It may also arrive on the system as an attachment to a spammed
email message.
Download Routine
When executed, this malicious JavaScript displays a fake loading page, similar to the ones belonging to the following Web-based email
providers, which contains a message saying that there is no available connection:
aol.com
gmail.com
hotmail.com
msn.com
yahoo.com
Thus, affected users are led to believe that the said Web page is inaccessible, even though an encoded file is already being downloaded by
this malicious JavaScript to the C:\Recycled folder. It eventually decodes and executes the said file on the affected system. As a result,
routines of the downloaded worm are also exhibited on the affected machine.
Trojan.Byte Verify
When Trojan.ByteVerify is executed, it performs the following actions:
1) Escapes the sandbox restrictions, using Blackbox.class, by doing the following:
a) Declares a new PermissionDataSet with setFullyTrusted set to TRUE.
b) Creates a trusted PermissionSet.
c) Sets permission to PermissionSet by creating its own URLClassLoader class, derived from the VerifierBug.class.
2) Loads Beyond.class using the URLClassLoader from Blackbox.class.
3) Gains unrestricted rights on the local machine by invoking the .assertPermission method of the PolicyEngine class in Beyond.class.
4) Several pornographic links are added into the favorites.
5) May attempt to retrieve dialer programs and install them on the infected computer. The dialer programs may attempt to connect the
infected computer to pornographic Web sites.
Trojan.ByteVerify will typically arrive as a component of other malicious content. An attacker could use the compiled Java class file to execute
other code. The file will likely exist as VerifierBug.Class. For example, an attacker could create an .html file that uses the Trojan, and then
create a script file that will perform other actions, such as setting the Internet Explorer Start Page.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 22 OF 30 PAGES
EXAMINATION REPORT
I reviewed executable files in an attempt to identify additional compromises that may have affected the Laptop. I
discovered the SMS.exe file located in the Dell Broadband folder and based on the file size, I believe this may be another
system compromise.
SMS.exe
SMS.exe, also known as Win32/Deathat.A Trojan, allows attackers to access your computer, stealing passwords and personal data. This process has
also been identified as a browser hijacker that modifies registry entries for homepage and start page, redirects searches to the programs servers and
generates pop ups.
CONCLUSIONS
Michael Fiola was issued a Dell Laptop computer on November 20, 2006 on or around 3:35 in the afternoon. That
computer was equipped with a Dell Broadband wireless card and Internet access through Verizon wireless. Earlier that
day, the Laptop was configured for Michael Fiolas use. At 11:42 a.m. on November 20th, the diauser account on the
Laptop was sent to the Recycle Bin. The Laptop was renamed from BOLLE04 to BOLIN17. At 3:05 p.m., a new profile
was created for michaelf, various updates were performed and software applications installed. Symantec Corporate
Edition was previously installed with the computer name BOLLE04 on September 20, 2006 but was reinstalled under the
profile for michaelf. Microsofts Systems Management Server had previously been installed on September 20, 2006
with the computer name BOLLE04 and it appears that the new computer name BOLIN17 was not changed in the SMS
software. According to the registry settings, the Windows Firewall was turned off.
The evidence shows that Michael Fiola used the Laptop for the first time during the evening of November 20, 2006. He
created several shortcuts to work related files such as mileage sheets, accessed several work related websites including
Massachusetts Municipal Association and Vision Appraisal Technology and added these websites to his Internet
favorites. On November 22, 2006, around 10:00 in the morning, the Laptop was used briefly to visit several work related
websites which were added to the Internet Favorites. The Laptop was not used during the Thanksgiving holiday and was
accessed again briefly the evening of November 26, 2006 to visit the WCRIBMA website which was also added to the
Internet favorites. Nothing of a pornographic nature was accessed during this time.
The very first evidence of pornographic activity appearing on the computer is on November 27, 2006 at 2:22 p.m. With
no preceding activity by Michael Fiola, a file titled smp[1].htm appears in the temporary Internet files folder. The
forensics software identifies this file type as unknown and the file is not viewable. However, the underlying HTML code
includes several URLs including http://popup.zaipal.info and titles such as PearlLolitas and PreteenFlowers. 2 seconds
later, the popup.zaipal[1].htm appears in addition to several other unusual files with similar content. This activity
continues for approximately 2 minutes and then all activity on the Laptop ends. Because there was no user activity that
prompted these files to appear such as an Internet search, access to other websites, checking email or downloading
files, this suspicious activity is indicative of a virus and/or Trojan that was likely resident on the Laptop when Michael
Fiola received it.
Again on December 6, 2006, with no preceding activity by Michael Fiola, suspicious files appear in the temporary Internet
files folder and pornographic images begin to appear with no origin. On December 7, 2006, at 9:10 a.m., pornographic
images begin appearing with no origin along with a suspicious JavaScript file titled Script[1]1.js. This file contains
Russian comments regarding the purpose of the code, the term sun bbs, and a listing of search engines including
Google, MSN and several Russian search engines. The script file also includes redirection code and the URL for
trafficout.net which is a fake host redirector. This JavaScript file is clearly the result of a virus and/or Trojan that has
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 23 OF 30 PAGES
EXAMINATION REPORT
compromised the Laptop. By the end of the day on December 7th, multiple instances of the Downloader Trojan,
Bloodhound.Exploit.95 and Trojan.ByteVerify have been identified on the Laptop by the Symantec software.
As the virus and Trojan activity continues to worsen on the computer through January, February and into March, so does
the unexplained and unprompted pornographic activity.
On February 8, 2006, the Laptop appears to have been turned on and several work related websites are accessed
including Massachusetts Tax Assessors and City of Brockton Assessors. Within seconds of these websites being
accessed, pornographic images being to appear on the Laptop with no apparent origin and no preceding activity by
Michael Fiola. The pornographic activity continues at a high rate of speed indicative of virus/Trojan activity inasmuch as
no computer user could physically create usage at this rate of speed. Website files are being created on the computer at
the rate of 20 to 40 pages per minute. Many of these pages appear with no content and the message Service
Temporarily Unavailable, which mirrors the description of the Feebs Family virus.
On February 14, 2006, the pornographic activity is the most prominent. At 11:06 a.m., an unusual search page in a
foreign language appears with results for bbs result pussy. At 12:43, an MSN search page appears with another
unusual term sun Lolita bbs, the very same keywords and search engine contained within the suspicious JavaScript file
that appears on the Laptop on December 7th. More than 20 search results screens appear on this date with 7 of those
search terms including the word bbs. The term bbs is commonly used to refer to the electronic Bulletin Board System.
The BBS was created in the late 1970s, connecting computers with phone modems and phone numbers for the purpose
of sharing information and became obsolete in the 1990s with the popularity of high speed Internet access and the
World Wide Web. Since BBSs have not been active in almost 20 years, the use of this term as a current search term
makes no sense and seems suspicious. The searches are even more suspicious when compared with the JavaSript file
that contains foreign language, foreign search engines and the term sun bbs. Combined with the large number of
compromises attacking the Laptop, the activity on this date looks as if it is being generated by a virus/Trojan and/or
hacker.
There are additional oddities connected to the activity on this date, specifically with regard to the search results screens
that appear in the temporary Internet files. Several of the search results screens and the pornography appear during the
very same minute that Michael Fiola is logging onto the CMS system. While it is certainly possible to multi-task on a
computer, it is highly unlikely that Michael Fiola is conducting a search, accessing a website and logging in to the CMS
system for the purpose of entering information all in the very same minute. Additionally, the search results pages appear
but the websites that follow do not match the results page. For example, a search screen appears for non nude pre
teen sites, but the website that follows is a website named Fetishcon that contains scat pornography; not a link from the
results page and completely out of context to the search.
Most interesting about February 14, 2006, is the activity that happens in the evening when, according to Michael Fiola,
Robin Fiola and the Affidavit of Monica Domey, the Fiolas are at II Piccolo restaurant from 6:00 to 9:30 p.m. At 7:36
p.m., the downloader Trojan is identified by Symantec on the Laptop. At 7:37 p.m., according to the SMS logs, someone
logs into the computer. Several minutes later, pornographic images begin appearing on the Laptop with no origin or
preceding event. Pornography continues appearing on the computer for approximately one and a half hours with periods
of time when 20 to 40 websites are being created within the same minute. The activity ends at 8:56 p.m. when the
computer shuts down. All of the activity during this time period is highly suspicious and indicative of a virus, Trojan
and/or hacker.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 24 OF 30 PAGES
EXAMINATION REPORT
On March 8, 2007, more suspicious pornographic activity is noted. At 11:50, several real estate websites are accessed
and then without any preceding activity, the Best Candid.com website appears. Approximately 30 minutes later, a
search results page for coolnetsearching.info appears with the search terms code help myspace and help desk
services. MySpace is a social networking website where people share personal information, pictures, instant messages,
etc. and is most commonly used by teenagers. MySpace codes are add-ins to the MySpace profiles that includes design
layouts, backgrounds, graphics, animations and other generators and are used by MySpace customers to create
dynamic profiles. I ran a search on MySpace for Michael Fiola and no account exists for him. In addition, no other
MySpace activity appears on the Laptop. On previous cases that involve MySpace accounts there are hundreds if not
thousands of MySpace files on the computer. The lack of any MySpace files indicate that Michael Fiola did not have a
MySpace page making it highly unlikely that Michael Fiola was searching for MySpace codes. Even more unlikely is that
Michael Fiola was using the site coolnetsearching.info to conduct a search for MySpace codes. I researched this site
and the only information provided is that the user of coolnetsearching.info has blocked the site which is suspicious in and
of itself. Further, there are several search engines available to computer users with the most common search engines
being Google, Yahoo, MSN, AOL and AltaVista. In fact, all of the legitimate searches that appear on the computer were
conducted using the Google search engine. On this particular date, search screen results pages appear for
coolnetsearching.info, Netster and ToSeekA.com, all very uncommon search engines. At 13:34, two search results
pages for ToseekA.com appear with the terms social studies activities and what is divorce. All of the activity on this
date appears suspicious and out of character and leads me to believe the activity is the result of a virus, Trojan and/or
hacker.
In general, the pornography found in the temporary Internet files folder does not represent activity conducted by a user,
specifically Michael Fiola. I have analyzed hundreds of computers, most of which contain pornography. Computer users
who are interested in pornography, whether it be adult pornography, child pornography or some other fetish
pornography, all have patterns. When accessing pornography on the Internet, websites are accessed through links on
portal sites, via Internet searches, by typing in a known URL, hyperlinks in emails, chats and instant messages or links in
the Internet favorites. When a website is accessed, the user typically gets to the next website by clicking on images that
interest them or by clicking hyperlinks to other sites. In this instance, the pornography appears out of nowhere with no
portal. When a website appears, none of the links are followed and the images are not clicked on. The pornography
comes fast and furious with no pattern. While search results pages appear, the pages that follow do not come from links
on the search results page and the content that appears next does not match the search. In addition, the content itself is
sporadic child pornography, scat sites, urination sites, gay men, incest, large women, etc. This activity is more
indicative of a virus, Trojan or hacker than an individual browsing the Internet for pornography.
It is evident from reviewing the Symantec logs that the virus protection software was either not configured correctly or
was not functioning properly. Log files for November and December are missing and entries for November are
incomplete. File scans are taking less than a minute to complete, scanning less than 400 files out of 108,000. Virus
definition files try to load and fail. Viruses and Trojans are attacking the system consistently day after day without
resolution allowing the compromises to grow and worsen. The shellexp.exe virus file was found in the registrys Run
folder, allowing the file to execute each time the computer booted up. Although we know for sure that the system was
badly infected and there is information with regard to the damage that these infections cause, we do not know to what
extent the system was compromised. It is unknown what viruses and Trojans infected the computer during those four
and a half months that were not recorded by Symantec or that did not leave a trace in the file system. One of the first
things that viruses and Trojans do is disable the antivirus protection software. Once they have been allowed to execute
their code, they erase evidence of their tracks making it impossible to assess the damage. While it is impossible to say
how badly the Laptop was infected while it was in the possession of Michael Fiola, I can say with 100% certainty that the
Laptop was compromised by numerous viruses and Trojans and may have been hacked by outside sources.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 25 OF 30 PAGES
EXAMINATION REPORT
To further complicate the matter, the SMS software that allows the IT department to communicate with, monitor and
maintain the Laptop did not function from the moment Michael Fiola received it.
Investigation by the DIA

The computer was removed from Michael Fiolas possession around 1:00 p.m. on March 13, 2007. According to the file
activity on the computer and the CCMExec.log file, the computer was accessed on March 13, 2007 from 1:00 p.m.
through 4:08 p.m. and again on March 14, 2007 from 8:32:41 a.m. through 8:34 a.m. The computer was last properly
shutdown on March 14, 2007 at 8:34 a.m. This indicates that the DIA spent approximately 3 hours investigating the
computer to make their determination that Michael Fiola was responsible for the pornographic activity found on the
Laptop.
On June 26, 2007, John Glennon testified at an administrative hearing regarding the investigation of the Laptop. He
stated that he is responsible for all information technology resources for the company and he is in charge of tracking the
computers and he was involved in the investigation of the misuse of the Laptop. Mr. Glennon testified that there is no
evidence that anyone else other than the Administrator had ever accessed the Laptop. However, a review of the
computer revealed several other accounts that had been created on the Laptop prior to Michael Fiola including diauser,
user, test and test2. Unfortunately, all previous accounts had been deleted, thereby eliminating potentially relevant
evidence. A review of the SMS and Symantec logs also revealed that the computer was previously setup for BOLLE04
and was actively used prior to the Laptop being issued to Michael Fiola.
Mr. Glennon went on to testify that it is highly unlikely for Internet files to be on the computer without activity by the user
and that there is no way for files to be in the Internet folder without browsing the Internet. A review of the Symantec logs
by Mr. Glennon would have revealed the viruses and Trojans that were attacking the Laptop for four and a half months.
A review of those viruses and Trojans by Mr. Glennon would have provided an explanation regarding how temporary
Internet files can be created on the computer without the users knowledge. A review of the temporary Internet files
themselves would have revealed suspicious patterns such as pornography appearing with no preceding event;
pornography appearing immediately after viruses and Trojans appearing; and 40 website files all created at the same
time, a scenario likely impossible for a user to create by browsing the Internet. If Mr. Glennon had discovered the
suspicious JavaScript files on the Laptop, he would have learned of additional methods in which files can appear in ones
temporary Internet files folder without their action or knowledge. At the very minimum, Mr. Glennon, as the head of the
IT department, must be aware of spam and Internet pop-ups that cause files to be placed in the temporary Internet files
folder without any action or knowledge by the user.
Mr. Glennon also testified that our networks are very secure and theyre monitored so it is highly unlikely that the
system was hacked. A review of the SMS logs by Mr. Glennon would have revealed that the SMS software was not
functioning and as a result, there was no communication with the Laptop while it was in the field for four and a half
months leaving the Laptop unmonitored. If, in fact, the networks are monitored, why were the SMS logs riddled with
errors - highlighted in yellow and red by the software for easy detection and unresolved for four and a half months? If
the networks are monitored, why did the virus attacks on the Laptop recorded by Symantec go unnoticed and unresolved
for four and a half months?
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 26 OF 30 PAGES
EXAMINATION REPORT
Finally, Mr. Glennon testified that he received the Verizon wireless bill and noted that the data usage for Michael Fiolas
Laptop was abnormally high. He identified this is a red flag and instructed his employee, Andrew Stevens, to
investigate the Laptop.
According to the testimony and the evidence, the temporary Internet files folders were copied from the Laptop on March
13, 2007 between 3:11 and 3:50 p.m by Andrew Stevens and the Laptop was turned over to the HR department. While
conducting my forensics examination in Boston, I exported these very same files without any of the graphics for future
analysis. While the files were exporting, the Symantec antivirus protection software on my forensic laptop continued to
display messages that viruses were detected within these files. In fact, these files continued to create problems on my
forensic computer during the entirety of my exam. When Andrew Stevens copied these files on March 13, 2007, he
should have received the very same virus messages and warnings if there was properly functioning antivirus protection
software.
Timothy McMahon, who was involved in the investigation and assisted in making the decision to discharge Michael Fiola,
testified at the administrative hearing that the investigation conducted by the DIA was thorough and complete. According
to Mr. McMahon, the investigation established through travel records, daily logs and accessing the mainframe that the
computer was in Michael Fiolas possession during the pornographic activity and that is how they came to the decision to
discharge him.
It is their opinion that Michael Fiola must be responsible for the activity because it was only happening when he
possessed the Laptop out in the field. How else could viruses, Trojans and hackers attack a Laptop? The Laptop must
be turned on for the viruses and Trojans to execute or for a hacker to gain access to it. Therefore, the Laptop could only
be compromised when Michael Fiola had the Laptop turned on and he typically had the Laptop turned on when he was in
the field. He did not need the Laptop at the office because he had a desktop computer at the office, therefore the Laptop
was not compromised during those times. In addition, viruses and Trojans typically need some event to occur in order to
trigger their execution. For example, when the Internet browser is opened, it may trigger the downloader to download a
back door which in turn allows the hacker to gain access. Therefore, when Michael Fiola opens his Internet browser to
access a work-related website, checks his email or logs into the DIA mainframe, the trigger is pulled, the virus or Trojan
begins its attack and the activity subsequently appears to be caused by Michael Fiola.
With only 3 hours spent on the Laptop by the DIA, they could not possibly have conducted a thorough investigation into
the activity that may have caused the pornographic material that appeared on Michael Fiolas Laptop. I have spent over
100 hours conducting a thorough forensic examination of the Laptop in order to reach the preliminary results and
conclusions contained in this report and my investigation continues. It appears that the only investigation by the DIA was
to copy the temporary internet files and confirm that child pornography existed on the computer when it was in Michael
Fiolas possession.
If the DIA had reviewed the Symanec logs, they would have discovered the numerous viruses and Trojans attacking the
Laptop for four and a half months without resolution; that log files were missing or incomplete; that virus definition
downloads were failing; that virus scans were only taking 30 seconds to complete. If the DIA had reviewed the SMS logs
they would have discovered the numerous errors that began the moment Michael Fiola received the Laptop thereby
leaving the Laptop unmonitored and unmaintained for four and a half months. If the DIA had reviewed the temporary
Internet files they would have discovered suspicious activity occurring day after day including the appearance of
pornography with no preceding event; websites being cached to the hard drive at the rate of 20 to 40 per minute;
JavaScript files with malicious code. What should have been a red flag to Mr. Glennon and the IT department when
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 27 OF 30 PAGES
EXAMINATION REPORT
they found the Verizon wireless data usage to be four and a half times that of any other user is that the Laptop may have
been compromised by a virus, Trojan or hacker.
FORENSIC TOOLS USED

Hardware
Forensic Laptop Dell Latitude D820
2.2ghz AMD Dual Core processor
2gb RAM
Windows XP Professional
FastBloc Write Blocker
Software
FTK Version 1.7.0 build 07.01.09
EnCase Version 6.8
Registry Viewer Version 1.4a
Mount Image Pro Version 2
Net Analysis Version 1.37
DISCLOSURE REVIEWED
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
Department of Industrial Accidents Appeal Hearing transcript taken June 5, 2007

Department of Industrial Accidents Appeal Hearing transcript taken June 26, 2007
Letter from Paul Buckley to Michael Fiola dated March 14, 2007
Letter from Michael Fiola to Rick Barry
Letter from Richard Barry to Michael Fiola dated June 7, 2007
Letter from David Duncan to Alan Baum dated June 28, 2007
Affidavit of Monica Domey
Emails from Robin Fiola to Tim Bradl
Screen shot showing temporary Internet files created on March 13, 2007 on Kingston (E:) identified as Exhibit 9
Verizon Wireless Overview of Lines identified as Exhibit 10
Commonwealth of Massachusetts Department of Industrial Accidents Daily Attendance for Michael Fiola
identified as Exhibit 11
Sho_Michaelf_Logins.txt identified as Exhibit 12
Employee Reimbursement Form identified as Exhibit 13
EnCase report prepared by examiner Swan
THIS REPORT CONTAINS HYPERLINKS TO SUPPORTING DOCUMENTATION INCLUDED ON

THE ATTACHED CD-ROM.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 28 OF 30 PAGES
EXAMINATION REPORT
GLOSSARY OF COMPUTER TERMS
The following are common computer terms that may be used in this report:
ALLOCATED SPACE: Allocated, or used, space is the area of a hard disk that holds files that are recognized by the
operating system. This recognition is accomplished via a file allocation table of some type. Different types of operating
systems use different types of allocation tables to keep track of files.
COMPUTER EVIDENCE: Computer evidence is unique when compared with other forms of "documentary evidence."
Unlike paper documentation, computer evidence is fragile, and a copy of a document stored in a computer file is
Identical to the original. Thus, the legal "best evidence" rules change when it comes to the processing of computer
evidence.
COMPUTER FORENSICS: Computer Forensics deals with the preservation, identification, extraction, interpretation
and documentation of computer evidence. Like any other forensic science, computer forensics involves the use of
sophisticated technology, tools and procedures that must be followed to guarantee the accuracy of the results.
Typically, computer forensic tools exist in the form of computer software and hardware write-blocking devices.
Computer forensic examiners guarantee the accuracy of evidence processing results through the use of time tested
procedures, and through the use of validated software tools from independent developers.
FILE SLACK: Files are created in varying lengths depending on their contents. Windows based computers store files in
fixed length blocks of data called clusters. Rarely do file sizes exactly match the size of one or more clusters perfectly.
The data storage space that exists from the end of the file to the end of the last cluster assigned to the file is called "file
slack". File slack potentially contains randomly selected bytes of data from computer memory. This happens because
Windows normally writes in 512 byte blocks called sectors. Clusters are made up of blocks of sectors. If there is not
enough data in the file to fill the last sector in a file, Windows makes up the difference by padding the remaining space
with data from the memory buffers of the operating system. This randomly selected data from memory is called "RAM
slack" because it comes from the memory of the computer. RAM slack can contain any information that may have
been created, viewed, modified, downloaded or copied during work sessions that have occurred since the computer
was last booted. Thus, if the computer has not been shut down for several days, the data stored in RAM slack can
come from work sessions that occurred in the past. It should be noted that the newer versions of the Windows
operating system zero out (write all zeros to) the RAM slack when a file is created. RAM slack pertains only to the last
sector of a file. If there are additional, unused sectors between the last sector of the file and the end of the cluster, this is
called "drive slack." Unlike RAM slack, which comes from memory, drive slack is made up of the data that was stored
on the storage device prior to the file in question. Such data could contain remnants of previously deleted files.
GB: A Gigabyte (GB) is a unit of computer memory or storage capacity equal to 1,073,741,824, or roughly one billion,
bytes or characters. One gigabyte of storage space is the equivalent of 500,000 double-spaced pages of text. Hard
disks capable of storing one-hundred gigabytes of data are now commonplace in desktop computers. Such storage
devices could contain the equivalent of 50 million pages of data.
INSTANT MESSAGING (IM) : IM is a text-based computer conversation over the Internet between two or more people
who must be online at the same time, and who must be using the same instant messaging system. Current, popular IM
systems are AOL's Instant Messenger (AIM), AOL's ICQ, Microsoft's MSN Messenger and Yahoo! Messenger.
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 29 OF 30 PAGES
EXAMINATION REPORT
JPG/JPEG: Joint Photographic Experts Group (JPEG or shortened to JPG) is a compressed format for storing bitmap
images, and is one of the most common image formats used on the Internet. Other common image formats include
ART, BMP, GIF(F), and TIF(F).
KB: A kilobyte (KB) is a unit of computer memory or storage capacity equal to 1,024 bytes or characters.
MB: A megabyte (MB) is a unit of computer memory or storage capacity equal to 1,048,576, or roughly one million,
bytes or characters.
METADATA: Metadata can be described simply as "data about data", or as a hidden level of information embedded in a
file and maintained by the application that created the file. For example, Microsoft Word documents contain metadata
showing the author of the file, the author's company, the number of file revisions, total editing time, and its own set of
created, accessed and written dates. Most digital cameras save images with metadata embedded in the file showing
the make and model of the camera, the date and time the photograph was taken, and the values of many of the
camera's settings, such as exposure, flash, focal length, etc.
OPERATING SYSTEM (OS): An OS is set of software programs used by a computer to manage its own resources,
such as recognizing input from the keyboard, sending output to the display screen, keeping track of files and directories
on the disk, and controlling peripheral device~ such as disk drives and printers. Examples of operating systems are
Windows 98, Windows XP, Mac OSX, Linux, and Unix. The OS is the core of the computer's operation, and application
programs such as word processors run on top of it.
PAGEFILE.SYS: The page file is a special file used by windows for holding temporary data which is swapped in and
out of physical memory in order to provide a larger virtual memory set. In a Microsoft Windows NT, Windows 2000 and
Windows XP environment, the file name is pagefile.sys and it is created during setup in the Root of the boot drive as a
hidden file. It will not show up on an Explorer file listing unless you toggle off the "Hide system Files" option.
PARALLEL ATA (PATA): For many years, Parallel ATA was the most common disk drive interface. Serial ATA has now
become the preferred disk drive interface due to its faster speed, smaller connector, and longer cable length. When
Parallel ATA was first introduced, it was an important advancement because it provided controller electronics on the
drive itself, eliminating the need for a separate adaptor card. It was easy to configure and was relatively inexpensive
compared to its traditional rival, SCSI. PATA uses 40-pin ribbon cables with a maximum length of 18 inches and a
maximum transfer rate of 133 MB/second.
PEER-TO-PEER (P2P) : P2P allows a sharing and delivery of user specified files among groups of people who are
logged on to a file-sharing network. Napster was the first mainstream P2P software that enabled large scale file
sharing. P2P networks are used to share multimedia files, such as music and movies. Typically, users place files they
want to share with others in a 'shared" folder on their computer. To access a P2P network you need to download,
install and run a P2P tool (P2P client software) . *The P2P software allows users to search for the types and names of
files they are interested in downloading. Examples of current, popular P2P software are Kazaa and Grokster (FastTrack
network), Limewire and BearShare (Gnutella network), eDonkey and Overnet (eDonkey/Overnet network), and
BitTorrent (BitTorrent network).
RAM: RAM, or Random Access Memory, is a type of memory that can be written to and read from in a nonlinear
(random) manner. When a computer program or application is opened, it is transferred from the hard drive to RAM
where it is more readily accessible. RAM enhances system performance because it can process requests from the
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT
DETAILS

0701CR4736
PAGE 30 OF 30 PAGES
EXAMINATION REPORT
CPU much more quickly than the hard drive. The kind of RAM used in main memory on most computers is Dynamic
RAM (DRAM) . DRAM stores data as electronic signals that must be constantly refreshed to keep them from
dissipating. The data held in PAM is lost when the computer is turned off.
UNALLOCATED SPACE/CLUSTERS: Unallocated space is the area of a hard disk that is not currently occupied by
saved files, but is free to have data written to it. Unallocated file space can contain the entire or partial content of
deleted files, deleted folders, and temporary files that were transparently created and deleted by computer applications
and the operating system. With manual or automated methods, it is often possible to "unerase" deleted files and view
the original content so long as the data area of the file has not been overwritten by other data, such as from a newer
file.
URL: Uniform Resource Locator (URL) is the address of a resource on the Internet. World Wide Web URLs begin with
http://
ORGANIZATION
TAMI L. LOEHRS
LAW2000, INC.
SIGNATURE
DATE
2/21/2008
EXHIBIT

CP Forensic Analysis PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CP Forensic Analysis PDF

Uploaded by

Copyright:

Available Formats

DETAILS

Commonwealth vs. Michael Fiola

THIS IS A PRELIMINARY REPORT OF AN ONGOING FORENSICS ANALYSIS.

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Time Zone Settings (minutes)

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Sunday, Week 1 of Month 4, Hour 2

PROCESSOR..., 80539, YONAH, T2400, 1.83, C0

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

DUAL IN-LINE MEMORY MODULE..., 1GB, 667, 128X64, 8K, 200

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

D:\Documents and Settings\administrator.DIA

Link file created to the 40 cent mile sheet

November 27, 2006

Worcester website is accessed

Restore point .ini files

Commonwealth vs. Michael Fiola

shows its a child pornography site TOPKDS LOLITA BBS

Restore Point .que files

Websites accessed including weather and Worcester Works.com

Restore Point .que files

Restore point.que files

Commonwealth vs. Michael Fiola

Symantec log reports Trojan.ByteVerify

December 11, 2006

Restore Point .que file

December 21, 2006

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Spencer Mass website

Restore Point .que files

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Restore Point .que files

January 11, 2007

Restore Point .que files

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Restore Point .que files

February 14, 2007

Website for Massachusetts Government

Restore Point .que files

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

VBN finds downloader

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Real Estate websites

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola

Link File Path:

Link File Path:

Commonwealth vs. Michael Fiola

0LUJC5A7{v I3B2.O6 6_2_~1.JPG(O6m6%

C:\Documents and Settings\michaelf\Desktop\rock.est

TYPED EXAMINERS NAME

Commonwealth vs. Michael Fiola