Case Study 1 — The Cover-Up Wrote a Second Case

A departing engineer copied proprietary CAD files to a personal drive, then spent ten Saturday-morning minutes trying to erase the evidence — backdating the files, wiping free space, emptying the Recycle Bin. Every act of concealment left a dated, attributed trace. By the time the matter reached deposition, the cover-up was a bigger problem for him than the theft.

Background

This is the second home of anchor case #2. A manufacturer of industrial turbine components — call it the plaintiff — discovered that a senior mechanical engineer, jrivera, had given notice to join a direct competitor. Routine offboarding flagged a personal USB device connected on his last Friday evening. The matter became a civil trade-secret suit. Counsel for the plaintiff already held the access evidence developed in Chapter 16 — Windows Forensics: a USBSTOR record for a SanDisk Cruzer Glide (serial 4C530001234567890123), a MountPoints2 mount attributed to jrivera, ShellBags for E:\ProjectArchive\TurbineHousing\, and a LNK proving TurbineHousing_v7.sldprt was opened from the removable volume.

What counsel did not yet have was an answer to a different question, and it would prove decisive: did the suspect attempt to destroy evidence? You were retained to run a dedicated anti-forensics detection pass against the verified image WS-ENG-04.E01 (SHA-256 recorded at acquisition, working copy hashed before analysis) and to report each indicator to its limit. You did not touch the original; every command ran against the hashed working copy, with each extracted artifact re-hashed into the chain-of-custody worksheet.

The detection pass

You worked the six-step pass in order, and four acts of concealment surfaced — each corroborated by independent artifacts so that no single tool's quirk could carry the finding.

Act 1 — backdating (timestomping). Explorer showed the Desktop copy of TurbineHousing_v7.sldprt with a Modified date of February 2022 — implausibly old for a current design. The $SI`/`$FN comparison exposed it in one istat:

istat -o 2048 WS-ENG-04.E01 84120   (excerpt)
$STANDARD_INFORMATION  Created 2022-02-11 10:00:00.0000000   ← Explorer shows this (FORGED)
                       MFT-Modified 2024-03-16 09:13:58.6042217  ← leaked real stomp time
$FILE_NAME             Created 2024-03-15 18:58:13.4471902   ← kernel-set (TRUTH)

A file cannot be born in 2022 if its name record was born in 2024 — the impossibility is the proof. Two supporting tells confirmed it: the forged $SI` fields carried zeroed sub-seconds (`.0000000`) against the genuine `.4471902` in `$FN, and the $SI` MFT-Modified field *leaked* the real moment the stomp ran, `09:13:58`. The USN journal (`$J) sealed it with a BasicInfoChange record at that same instant and a FileCreate at 2024-03-15 18:58. Five independent confirmations; the 2022 date was a forgery.

Act 2 — wiping free space. The entropy scan flagged a vast contiguous low-entropy (zeroed) region in unallocated space — the signature of a free-space wipe. The tool convicted itself three ways: SOFTWARE\Piriform\CCleaner was present with "wipe free space" enabled; CCLEANER64.EXE-A1B2C3D4.pf reported run count 3 and a last run of 2024-03-16 09:14:22; and UserAssist in jrivera's NTUSER.DAT bound the GUI launch to that account. The cleaner cleared what its authors anticipated — browser history, MRU lists — and could not erase its own Prefetch, Amcache hash, or UserAssist tally, because Windows wrote those about CCleaner as it ran.

Act 3 — emptying the Recycle Bin (defeated by surviving metadata). Two $I` records under `$Recycle.Bin\<jrivera-SID>\ survived, recording TurbineHousing_v7.sldprt and a sibling deleted Saturday at 09:12 — original path, size, and deletion time intact even though the $R content was gone.

Act 4 — the dated gaps (absence as evidence). Browser history ended cleanly at 09:14; several MRU keys held no values yet carried a 09:14 last-write. You did not stop at "suspicious." You tested the innocent hypotheses: the registry confirmed Prefetch was enabled, the System log's boot history proved the machine had run for months, and the holes aligned to the same minute as the cleaner's execution. The absences corroborated rather than misled.

Assembled, the concealment timeline overlaid the theft timeline exactly:

WS-ENG-04 — CONCEALMENT TIMELINE (UTC), user jrivera
Fri 18:58     File created on Desktop            [$FN truth; $SI later forged to 2022]
Sat 09:12     File + sibling to Recycle Bin      [$I metadata survived emptying]
Sat 09:13:58  Timestomp applied                  [$SI MFT-Modified + USN BasicInfoChange]
Sat 09:14:22  CCleaner run #3, wipe-free-space   [Prefetch + UserAssist + Amcache]
Sat 09:14     History cut; MRUs emptied-but-dated[absence = dated trace]

At deposition, the defense expected to fight over CAD file formats and whether "opened from" proves "copied to." Instead, opposing counsel's own expert had to concede each concealment finding, because each rested on multiple independent artifacts and you had stated every limit in advance — you never claimed motive, only that the $SI timestamps were altered and the kernel-set sources placed creation in March 2024. The plaintiff moved for spoliation sanctions. Faced with the prospect of an adverse-inference instruction — the jury being told it could assume the destroyed material was unfavorable — the defendant settled on terms that reflected not just the theft but the documented attempt to hide it.

The analysis

  1. The attempt to hide evidence is itself evidence. Four acts meant to erase the trail each added a dated, attributable line to the timeline. The cover-up did not weaken the case; it created a second one — spoliation — on top of the first.
  2. Corroborate every concealment finding across independent artifacts. The timestomp rested on five sources, the wipe on three, the deletions on surviving $I metadata. A finding built on one artifact can be impeached; a finding where five independent clocks agree cannot.
  3. Test the innocent explanation before alleging anti-forensics. Empty-but-dated MRUs are a lead until you confirm Prefetch was enabled, the machine ran for months, and the timing aligns. The discipline of excluding alternatives is what makes "absence" admissible.
  4. A tool cannot erase the record of its own execution. CCleaner cleaned everything its authors enumerated and nothing they did not — Prefetch, Amcache, UserAssist, and the installation key all survived because the operating system wrote them.
  5. Report the action, never the mind. "The $SI` timestamps were altered to 2022; the `$FN, USN journal, and three artifacts place creation at 2024-03-15" is a finding. "He backdated it to cover his tracks" imputes intent you cannot read from an MFT record. Stating findings to their limit is exactly what made them unimpeachable.

Discussion questions

  1. The defendant's strongest pre-deposition hope was to contest "opened from" versus "copied to." Explain why the concealment findings made that distinction nearly irrelevant to the outcome, and connect this to the chapter's point that evidence of a cover-up can outweigh the underlying act.
  2. For the timestomp finding, list the five independent sources cited and explain what each contributes. Which single source would you treat as the weakest on its own, and why?
  3. The examiner confirmed Prefetch was enabled and the machine had run for months before calling the empty MRUs evidence of wiping. Walk through what the report should say if those checks had instead shown Prefetch was disabled by group policy.
  4. ⭐ Suppose the suspect had additionally run DBAN to wipe the entire internal disk from boot media rather than CCleaner inside Windows. How would the available evidence change, what would the disk itself now show, and where would the investigation move? Would the case be stronger or weaker, and why?
  5. Tie this case to anchor case #2 as told in Chapter 16. The access evidence and the concealment evidence were developed by two passes answering two questions. Why is it good practice to separate "what did the user do?" from "what did the user try to hide?" — and how does each pass strengthen the other?