Investigation Dashboard

Case ngdc · Evidence: /evidence/ngdc
Executive Summary

📂18 sources (63 disk, 36 other)
🔍159 tool calls
⏱️28 minutes elapsed
🚨12 findings (7 critical, 3 high)
✅9 confirmed
🤔3 inference
❌1 hypothesis ruled out
🔒✓ SHA-256 hashes

The attack timeline spans 2012-06-15 to 2012-07-10. The earliest activity was Joe's Search History Reveals Intentional Keylogger Research and Deployment (2012-06-15). The investigation subsequently uncovered LogKext Keylogger Installed on Tracy's MacBook Air; Joe Installed LogKext Keylogger on Tracy's MacBook Air; Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents. The most recent activity was Tracy Facilitated Unauthorized Physical Access for Coral/Carry (2012-07-10).

Key Threats
  • LogKext Keylogger Installed on Tracy's MacBook Air
  • Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
  • Stolen NGDC Documents Found on Tracy's External Drive
  • Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject "things"
  • Joe Installed LogKext Keylogger on Tracy's MacBook Air

0
Total Findings
0
Critical
0
High
0
Medium
0
Confirmed
0
Inference
0
Sources
0
Tool Calls
Severity Breakdown
Critical (7) High (3) Medium (2)
⚠ Critical Findings
  • LogKext Keylogger Installed on Tracy's MacBook Air
    2012-06-28T15:41:39-04:00
  • Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
    2012-07-09T09:22:10-04:00 — 2012-07-09T13:01:52-04:00
  • Stolen NGDC Documents Found on Tracy's External Drive
    2012-07-09T09:22:10-04:00
  • Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject "things"
    2012-07-09T13:01:52-04:00
  • Joe Installed LogKext Keylogger on Tracy's MacBook Air
    2012-06-28T15:41:39-04:00
  • Coral Forwarded Stolen NGDC Documents to Perry Patsum
    2012-07-09T10:22:17-07:00
  • Joe's Search History Reveals Intentional Keylogger Research and Deployment
    2012-06-15T13:36:48-04:00
⚔ MITRE ATT&CK Coverage
Reconnaissance
Resource Development
Initial Access (1)
Execution (1)
Persistence (2)
Privilege Escalation (2)
Defense Evasion (2)
Credential Access (1)
Discovery
Lateral Movement
Collection (3)
Command and Control
Exfiltration (2)
Impact
Inhibit Response Function
Evasion
Impair Process Control
Initial Access (1)Execution (1)Persistence (2)Privilege Escalation (2)Defense Evasion (2)Credential Access (1)Collection (3)Exfiltration (2)
10 techniques across 12 findings
★ IOC Summary
External IPs0
Internal IPs3
File Paths2
Hashes0
Emails11
Investigation Metadata
Case IDngdc
Evidence Root/evidence/ngdc
Report Generated2026-04-20T14:15:47
Investigation Start2026-04-20T13:47:41
Investigation End2026-04-20T14:15:25
Total Processing2275.7s
Audit Log/root/.mulder/cases/ngdc.audit.jsonl

Evidence Hashes

SHA-256 hashes recorded at ingestion — verify with sha256sum <file>
89 FILES Hashes computed during evidence ingestion. Compare against your local copies to confirm integrity.
FileSHA-256Size
carry-phone-2012-07-03-initial.zip fb31cab9b61140f1693f01d46e79040f00a77b085d5efe9f5043e6cc09d00cde 118.4 MB
carry-phone-2012-07-05.zip 5ee6af1fecd97941cae3cb4b8996af4e745c3a75cb54bc7908df683b36c04b8b 118.7 MB
carry-phone-2012-07-06.zip 6b638f7808ec557dfee67deb5d0783f00bdd89509bc4330ffd8e41a451dda1e0 118.9 MB
carry-phone-2012-07-09.zip 6106823b00bfbcdfa95b143b57d3163b43627827511b2ebb8fdedee4834f8cb4 119.7 MB
carry-phone-2012-07-11.zip 57383e90a2198740ac3782896b9247217ab0377deadbbe74c28ca757fccb325a 124.8 MB
carry-phone-2012-07-15-final.zip 5cfec4e099e70529072b6934c6f98f97492985e5a48daeb64549f96719792d9e 190.6 MB
carry-tablet-2012-07-03.E01 e1d006ba87c89bcaedcb42b2416fab3cf15ce5be14787a0afed2510a963155b4 615.0 MB
carry-tablet-2012-07-03.tar 862fdf9f03950e56b3fc8aeecfe70074b1ba00d453de94da6bd7a0e8e6cf88e2 462.3 MB
carry-tablet-2012-07-05.E01 1eff8a1b6bf01fef28680ca904c88f6c9e9bca556d849a8ac7c4a6b1e11eb428 661.5 MB
carry-tablet-2012-07-05.tar c1492c4877be07464a41e60b874ba403d6014a89de4a38723501372b4b1f3945 499.3 MB
carry-tablet-2012-07-06.E01 fe7de1f766220ed073e5859b086788277ea16ceba260354bbf6980a6547b34d7 730.5 MB
carry-tablet-2012-07-06.tar 28e1cd84472cf53bcc972d635aa97713e1b6081aa5909dddbd7b8a6159a7d747 571.6 MB
carry-tablet-2012-07-09.E01 15415e1b0ba8b79dfcd0c645ab05e63af78618f3af2ef7ba73c462d4a4e54501 881.4 MB
carry-tablet-2012-07-09.tar b546df1398cb5f0da8d42c04f4c53575a49dcb4e7820babba5da2b72f9fe3634 694.1 MB
carry-tablet-2012-07-10.E01 87a31f45af472ca57d8a60f0f5bca77c6d97eea2927263199df9608fb268e630 884.9 MB
carry-tablet-2012-07-10.tar 475cfd7e6f6564e5aa8c8769131a260f2e6d4eaa0dd04e3e93a89cf059e4c966 694.0 MB
carry-tablet-2012-07-11.E01 96509d4bfe56b3c565f99424aa446b9e02b8a1d92a9cf70fccbdfe76c9364ed9 904.7 MB
carry-tablet-2012-07-11.tar 987a26f1ac03f932a5fb3a47c22b82ab12829f0767c9d052f1f86d0aa074cfc9 716.1 MB
carry-tablet-2012-07-12.E01 04c160a0b6d5b3da1820cdc644784b93eccdf415f912ae0892aa68fe2bafa25c 1.1 GB
carry-tablet-2012-07-12.tar ef427ef03aebc8bb97a742ca9b57e1c44383ff034f01d25b33031851f225ea81 777.2 MB
carry-tablet-2012-07-13.E01 15cd66db38924e83515726350e2ea8b05bd79159c360ffffbb9de4b39df293df 1.1 GB
carry-tablet-2012-07-13.tar f17e15728183b8965ea95932b6a1b30d57e87f3377976204ef0c6ca6bfacd5c3 778.6 MB
carry-tablet-2012-07-16-final.E01 26a6ea3049c06afdd34862c453fc272a5ab4c64954ae51d23cf9df688473a448 1.1 GB
carry-tablet-2012-07-16-final.tar c70762e49db8f95cfd11246a3e84d1fca8a20d7182d1525b462638a28331793f 778.8 MB
email.zip d1c4470e9e058f83798b6c0c2856e85df8747783f2105f8c354f366d30ab5505 15.8 KB
carry-phone-2012-07-09-0926.E01 4c73f99d5aa21aef548fab2fa8c6a412da7bdd970150c87061162db0e97d9039 25.2 MB
carry-phone-2012-07-09-1512.E01 48f46f900368175ab1027f8d9dc6834b36d67d0500843fa0aaa5fefe27687603 25.5 MB
carry-phone-2012-07-10-1627.E01 01ea788557b1ea121e4ef005d541c91d58932a1f5e51327c46f81ff4c416e8ac 25.5 MB
carry-phone-2012-07-11-1415.E01 deaf369f9f98883db958c93cf47bc3da2922cd7a2b3a5266d36bc16232188d70 25.5 MB
carry-phone-2012-07-13-1045.E01 824beba7c2d5a451d0f894ae96039bafd48dc2fe007bf7dcf4af2f42c174fb18 59.6 MB
carry-phone-2012-07-15-0535.E01 bfb36c7ff419500e6f3444e3efd432d865d47eb591d6df52a6840487194735eb 59.4 MB
carry-phone-FTK-2012-07-03.E01 a2f538f9104b07ea0a1e6ad5de453923e9f5ad006abc163c5a23229126bc3373 25.2 MB
carry-phone-FTK-2012-07-06.E01 f51c5606901d700a0a27b9f7ee2a90054172e4c3225d14a319ad05b0d0c045b3 25.2 MB
carry-phone-FTK-2012-07-09.E01 6ea887d2ba7774ab9573e53f5681c268f6aec8996c6fd67d9ca3a5e086b93318 25.5 MB
carry-phone-logical-2012-07-15-0618.zip cbcee1cb354884ebfa302ad5a6e41c9980fc3ba252b2f74e732b2162540f7357 29.1 MB
carry-tablet-2012-07-05-1839.E01 00e0957732be8f59f25e91f1067476722234d66a1a0e73b18921419ab7539264 237.6 MB
carry-tablet-2012-07-09-1604.E01 c284ed58eea491852b72d259425916483d220e36e3f6787430948c17f07b9551 467.9 MB
carry-tablet-2012-07-11-1859.E01 d7f007cd4abfef137a1dbb47c586109706d18a664ad0638481d3b26c9821e836 624.2 MB
carry-tablet-2012-07-12-1623.E01 97d730d7fefe112a0e99fc1421085afca06bf43a0dbf268d41fc7cc3100de372 594.9 MB
carry-tablet-2012-07-13-0415.E01 5e716412b6fe1622c0802dcac76007c560ff20a6fd107578013d841d71fe93e8 3.6 MB
carry-tablet-2012-07-13-0425.E01 b2de8e615c2a09f5319ab7c653d4e502f685ed0e069efb72f6fb4a176f06f214 595.2 MB
carry-tablet-2012-07-15-0532.E01 7cb9b127d0dc5501530cf8a67896121720a47a8107c69335e4b7d8b925d4b656 597.1 MB
carry-tablet-logical-2012-07-15-0907.zip e172f851877b6a335888f851d8d9929ef9bd0bdc5ecae083b2de3eeee512b165 314.3 MB
NOTES.txt 4c22a05b794476ffbbee471d0365fa3fad9959e8aa310e409ac3c4e4639085db 60.0 B
Tracy-phone-logical-2012-07-15-1317.zip 1e4287dff75dd2fb84ff46be3ef5f3152bb894b64030831b442776e522d30329 17.7 MB
ngdc-exterior-2012-07-06.pcap b2e89885b1c3775ddff8d106cdead6ae1b5331d53b3f539ac9c27010244c0895 142.3 MB
ngdc-exterior-2012-07-09.pcap dc317d6a9f6942148e726097e95d7f4d3bd0cc95bee0480d0797b60020147a8b 44.6 MB
ngdc-exterior-2012-07-10.pcap 863587be812b9ed6dd184ad0c5960d4ebe4e713b767a07860aec946a5442c73b 36.3 MB
ngdc-exterior-2012-07-12.txt d4a233442a7d86244f3017ee69481c3079aade7c577257eb09b3bda9a73e1f4d 244.6 MB
ngdc-interior-2012-07-06.pcap d5f019db5796bd2118d8b917ae26805bb6cb3c978fd983860035f599d8ccb051 35.3 MB
ngdc-interior-2012-07-09.pcap 67eb2629d2f29ea4b7101f3b03209621294b1bf0909d515927514b0c00dac449 38.2 MB
ngdc-interior-2012-07-10.pcap d47a9e1144c92a5a818b295546bf5c3219a2bb18a21bb9dcc9702ee48f200548 24.9 MB
ngdc-interior-2012-07-12.txt 2b2cbcc969cfa9d7dc7ad1087cc59e456e941c3c7c5d4416ba2a9ce0b83d7e66 4.2 MB
tracy-external-2012-07-03-initial.E01 1e5a3d79829acd983082208997f8751a62b04270c9a37504ca7618148075b388 3.5 GB
tracy-external-2012-07-05.E01 258424980de8fce8710af2e9cce3700c1fd41c8c532416122fd1ae176045d707 3.5 GB
tracy-external-2012-07-06.E01 0620934be3936a7f9cd808f312adb68250e7eacbc9ba66ccc61c4e24fc0a7b11 3.5 GB
tracy-external-2012-07-09.E01 13921c2bb5c79ac80e984db70265d54f3d085084cd1587b6db44f9e6d0eb2a30 3.5 GB
tracy-external-2012-07-10.E01 f4c9dcef754e97879d304dc62b2522e362084718f43ce716226d570ac6b890a2 3.5 GB
tracy-external-2012-07-11.E01 81995cb6772d23685f7bc569d7abe0bf5115943e294f6fa86bfcd6c0dcd795a1 3.5 GB
tracy-external-2012-07-12.E01 c703083132f551ccf57db79fd16c91bd97bd372a602f4d6fb4219b79a9a674bf 3.5 GB
tracy-external-2012-07-13.E01 a9fc2954067ebccdbb0f4ecd5f0ae7e1908d42c12bf6d3b2a05c76b3ce1a41f3 3.5 GB
tracy-external-2012-07-16-final.E01 bfff9410215485be97d57ed7064c576319cafacc4bfead179e070af77c5b6078 3.5 GB
tracy-home-2012-07-03-initial.E01 c248f4682ce80204167d0762f789f922ee5053c22baf83fa15cdbb9dac6bbcbe 4.0 GB
tracy-home-2012-07-05.E01 40e53ffc58e66c0693b46853855a70fc2881484cf411d24cd923aa8eec6139ab 4.0 GB
tracy-home-2012-07-06.E01 31320381fadfba284370068c573c8eb04d55a35e81b549520c21f7275e8089bb 4.0 GB
tracy-home-2012-07-09.E01 58eaa38cef2b4915b2f8b8b732c300499756f9f0e294c4be9b76d867d674e8f0 4.0 GB
tracy-home-2012-07-10.E01 596d52b960bbc754819f035ec4e2528ca2536761eb5ebb70a8116e40f1def2b1 4.0 GB
tracy-home-2012-07-11.E01 2690d2340903df7d71167f9e8d6c6b69ab5e79a9024846092787703c8bc51159 4.0 GB
tracy-home-2012-07-12.E01 91586fb0e1d5834c690a43bfe4e9e6c55fb4bd7048851de404896a4457ec83e5 4.0 GB
tracy-home-2012-07-13.E01 544ccb70fd064d3e48d5af8001d6a5b847908c62884a4ca0ddd30e72bbd49696 4.0 GB
tracy-home-2012-07-16-final.E01 26218dd0553a5f22cd11e98aae42e7b89c9739bba87ee8b1de5cd43a069ef17c 4.0 GB
tracy-phone-2012-07-03-initial.E01 3e5eb75fd0b1340485ff257a25811db1dad1deba193a00df77fb615d966886b7 755.2 MB
tracy-phone-2012-07-03-initial.tar e63bf43c73542263e26622790a8c41e1eb1ae047c4ed7b460b228923c6b36671 710.5 MB
tracy-phone-2012-07-05.E01 7410eb756ed1af9e12d8d8873f9faa164076214a62a042d1b93b3d935e7333b7 753.1 MB
tracy-phone-2012-07-05.tar aa8ac5304f5f12cf1eecb8462bd7aac5225f05ac42115bfebf5ad56befe86005 712.0 MB
tracy-phone-2012-07-06.E01 7c5342254e818d1b0ac87106f6c1bedae25d1e8e9022117eae6a0f1771f099f7 751.0 MB
tracy-phone-2012-07-06.tar 51e998631fe0092c01888ee05f205f57d64ebe6b86559080183913b3f9350589 712.2 MB
tracy-phone-2012-07-09.E01 6bdee47174559f6379906f0a530dcc9136a6c38b66866224e825ca653356f278 751.1 MB
tracy-phone-2012-07-09.tar c845267fad6a45414e87bdd76bfb8fb3d5f4e47925c19270e5776c7c99c42e4b 729.8 MB
tracy-phone-2012-07-10.E01 3e49d257d1eb421737af60d3e0bca91e49f47ba83193b6850bce2c480de5780a 751.9 MB
tracy-phone-2012-07-10.tar abba1fc999da1dc1bc5d67aa5ab959afa1a49f631293748fcffae98a022e5078 731.2 MB
tracy-phone-2012-07-11.E01 4e9246308fec0a0a43fc03350234b5c242ac58d0ae5022c0c596c35192d914ca 751.8 MB
tracy-phone-2012-07-11.tar aa89ba23dbb1801655471686dd6a321eb23aee3b7902a23117030f6f48fbb112 731.2 MB
tracy-phone-2012-07-12.E01 0d3d14a0b6391eb245dab9ac1c37952d5be12d3806a3a2e5b2d80bd321e42bc9 752.6 MB
tracy-phone-2012-07-12.tar 5cc5d3f908b313cbc6913689ee29ff27e24af11d2610a6430422205a5b5fc973 751.2 MB
tracy-phone-2012-07-13.E01 84ce162dc0f110b0a21977f23f317c7c26add7a443b88c3e56aeca7946a59294 752.1 MB
tracy-phone-2012-07-13.tar 7c1a7cc4b57826bcdc4e38daee3624a442e22bd7cfbefbef226103653d91e7a4 751.2 MB
tracy-phone-2012-07-15-final.E01 71aed05a86a753dec4ef4033ed7f52d6577ccb534ca0d1e83ffd27683e621607 751.9 MB
tracy-phone-2012-07-15-final.tar b209e812aeeab7b6234f8f6d16be6b63027e02d667d8882104bd52b3aea204a1 751.2 MB

Investigation Report

Case ngdc

NGDC Insider Threat and Unauthorized Surveillance Investigation Report

Background

The National Gallery DC (NGDC) investigation centers on the forensic examination of digital evidence from multiple subjects and devices collected between July 3 and July 16, 2012. The evidence encompasses 89 items including disk images of personal computers, mobile phones, and tablets belonging to two primary subjects — Tracy Sumtwelve and Carry Carsumtwotwelve — along with network packet captures from the NGDC work environment and email evidence containing keylogger output.

The investigation was initiated in connection with concerns about the security of a rare and valuable stamp collection exhibit scheduled to arrive at the National Gallery DC. The evidence reveals two distinct but interrelated incidents: an insider data theft conspiracy involving multiple actors, and an unauthorized surveillance campaign conducted through a kernel-level keylogger.

Incident Timeline

Mid-June 2012: Joe Sumtwelve, Tracy's ex-husband who maintained a user account on the shared family MacBook Air, began researching the LogKext keylogger. His search history reveals queries including "logkext," "logkext minmeg," "what does minmeg do logkext," and most troublingly, "is it ok to keylog children" — searched seven times. Joe also searched for "mac mail and crontab daughter," indicating he was configuring automated exfiltration of the keylogger's output.

June 28, 2012 (15:41 EDT): The LogKext kernel-level keylogger began operating on Tracy's MacBook Air, capturing all keystrokes from both user accounts — Tracy (tracysumtwelve) and her daughter Terry (terrysumtwelve). The keylogger was configured to email captured logs via Postfix (running as root) to joe.sum.twelve@gmail.com with the subject "Logfile" at approximately three-hour intervals. Joe subsequently deleted his user account from the MacBook Air, though the account directory remained as "Users/joesumtwelve (Deleted)" with recoverable Safari cache, bash history, and other artifacts.

June 29, 2012: Keylogger data captures Tracy communicating with "Perry" (Coral/Carry, via coralbluetwo@hotmail.com) about finding something valuable at work: "If anything comes up around the office that we can maybe... get in on... please lets try to do so. Kiddo is getting really bent out of shape about possibly having to switch schools." Tracy also advised caution: "Be careful! We have enough problems as it is, we can't be getting in trouble or losing our jobs."

July 2, 2012: Tracy researched financial assistance options (financial advisors, private school tuition help, alternatives to private school). She also emailed Joe asking for help with Terry's tuition at Prufrock Preparatory. Later that day, Tracy typed about a foreign exhibit arriving at NGDC with significant financial investment, noting the shipping costs appeared unusually low.

July 3, 2012: Tracy informed Coral that the gallery was expecting a "rare collection of stamps" and described it as "our ticket." She also emailed Pat (patsumtwelve@gmail.com) about the opportunity with the message "Good News" and noted "I just talked to Coral, she sounded ecstatic."

July 6, 2012 (11:49 EDT): Pat TeeSumTwelve (patsumtwelve@gmail.com) sent an email with subject "can't pass up" to King (throne1966@hotmail.com) with Coral (coralbluetwo@hotmail.com) on CC, broadening the conspiracy network. That same day, Tracy had lunch with Carry and later typed a thank-you email. Network captures show workstation 192.168.1.101 browsing the Louvre museum website and Wikipedia articles about the Palais du Louvre from the NGDC interior network.

July 9, 2012 (09:22-13:02 EDT): Tracy executed the data exfiltration. Keylogger data captures her terminal commands in detail: she navigated to her Documents folder, listed its contents, and created an encrypted ZIP archive of stamp insurance documents using the command zip -e documents.zip Stamp[...] Ins[urance] with the password "Hercules." She then emailed the encrypted documents to coralbluetwo@hotmail.com with the subject "things" and the message "Hey Perry, here are those documents I talked to you about. The password is your old dog's name."

July 9, 2012 (13:22 EDT / 10:22 PDT): Within approximately 20 minutes of Tracy's email, Coral forwarded the stolen documents to Perry Patsum (perrypatsum@yahoo.com) with the subject "Some things for you" — Message-ID: 4FFB1349.70506@hotmail.com. This rapid forwarding indicates the exfiltration chain was pre-arranged.

July 10, 2012: Keylogger data shows Tracy offering to help someone bring a tablet past NGDC security: "I can definitely help get your tablet in. Our security guards can be pretty ridiculous sometimes! When would you want to get in and take a look around?" Network captures confirm webmail access (Gmail and Outlook) from the NGDC interior network.

Post-July 9: Tracy moved documents.zip and related files to the Trash on her MacBook Air, along with intermediate files like "Stamp insurance 1 2.pdf" and "Stamp insurance 1.pdf.zip." The original documents remained in Users/tracysumtwelve/Documents/docs/ and copies persisted on the external USB drive under "NGDC things."

Key Findings

The investigation identified two distinct criminal acts occurring simultaneously on shared infrastructure:

Incident 1 — Insider Data Theft Conspiracy: Tracy Sumtwelve, an employee at the National Gallery DC, systematically collected confidential documents related to a rare and valuable stamp exhibit. The stolen documents included three stamp insurance valuation PDFs (Stamp insurance 1.pdf, Stamp Insurance 2.pdf, Stamp insurance 3.pdf), a security guard rotation schedule (securityrotation.pdf), and a blank NGDC letterhead template (NGDC_blank.doc). These documents were stored on Tracy's personal MacBook Air, transferred via her external USB drive (exFAT, "External"), encrypted into a ZIP archive with the password "Hercules," and emailed to her co-conspirator Coral/Carry (coralbluetwo@hotmail.com), who promptly forwarded them to Perry Patsum (perrypatsum@yahoo.com). The conspiracy involved at least five individuals: Tracy (insider), Coral/Carry (intermediary), Pat (facilitator), Perry Patsum (recipient), and King (additional conspirator).

Incident 2 — Unauthorized Keylogger Surveillance: Joe Sumtwelve installed the LogKext kernel-level keylogger on the family MacBook Air to monitor both his ex-wife Tracy and their daughter Terry. The keylogger operated as a macOS kernel extension with LaunchDaemon persistence, capturing all keystrokes system-wide. Joe configured Postfix to automatically email the keylogger output to his Gmail account at regular intervals. He then deleted his user account to conceal his involvement, though forensic artifacts (Safari history, installation receipts, kernel extension files) remained recoverable. Ironically, the keylogger Joe installed to surveil Tracy and Terry became the primary source of evidence documenting Tracy's insider theft activities.

Impact Assessment

The stolen documents pose a significant security risk to the National Gallery DC and the incoming stamp exhibit:

The stamp insurance valuations reveal the precise monetary value of individual items in the collection, enabling targeted theft of the most valuable pieces. The security guard rotation schedule provides intelligence about when specific areas of the gallery are staffed and when transitions occur — critical information for planning a physical intrusion. The blank NGDC letterhead template could be used to forge official communications, potentially to misdirect shipments, authorize access, or create fraudulent documentation.

The combination of these documents transforms what might be opportunistic curiosity into actionable intelligence for art/stamp theft. The rapid forwarding chain (Tracy → Coral → Perry, within 20 minutes) and the pre-arranged encryption password suggest this was a coordinated operation, not an impulsive act.

The keylogger surveillance, while a separate criminal act, inadvertently served as the most comprehensive evidence source for the investigation. However, it also represents a serious violation of Tracy and Terry's privacy, with every keystroke — passwords, personal correspondence, schoolwork, and private searches — captured and transmitted to Joe.

Recommendations

  1. Immediate security response: Rotate all NGDC security procedures documented in the exfiltrated securityrotation.pdf. Change guard schedules, entry protocols, and any access codes that may have been compromised.

  2. Exhibit protection: Implement enhanced security measures for the incoming stamp collection, including additional surveillance, access controls, and inventory monitoring, given that conspirators now possess detailed insurance valuations.

  3. Legal action: Refer the insider theft to law enforcement for prosecution of Tracy Sumtwelve, Carry Carsumtwotwelve (Coral), Pat TeeSumTwelve, Perry Patsum, and the individual known as "King" (throne1966@hotmail.com). Separately refer Joe Sumtwelve for unauthorized computer access and surveillance.

  4. Network security: Review the NGDC network architecture. The SSL-stripping middleman captured useful forensic data but also represents a significant privacy concern and potential legal liability for the organization.

  5. Data loss prevention: Implement controls to prevent employees from emailing confidential documents to personal accounts, including monitoring for encrypted attachments and bulk document access.

  6. Device forensics: The MacBook Air should be preserved as evidence. The LogKext keylogger should be removed only after all forensic preservation is complete. The external USB drive and Carry's tablet contain critical corroborating evidence.

Conclusion

This investigation reveals a carefully orchestrated insider threat driven by financial desperation. Tracy Sumtwelve, facing mounting private school tuition costs and divorce-related financial pressures, identified the incoming stamp exhibit as a potential source of income. Working with a network of co-conspirators including Coral/Carry, Pat, Perry Patsum, and King, she exfiltrated confidential NGDC documents containing stamp valuations and security schedules. The exfiltration chain — from encrypted ZIP files on the MacBook Air to email transmission to Coral, who forwarded to Perry within 20 minutes — demonstrates premeditation and coordination.

The concurrent discovery of Joe Sumtwelve's keylogger surveillance adds complexity to the case but also provided the most detailed forensic evidence available. The keylogger captured Tracy's terminal commands, email compositions, and password entries in real-time, creating an irrefutable record of the theft activities.

The evidence supports the conclusion that the document theft was preparation for a potential physical theft of items from the stamp exhibit, though no evidence of an actual completed theft was found within the investigation timeframe. The stolen security rotation schedule and insurance valuations would be most useful in the planning phase of such an operation.

Attack Timeline

11 events ordered chronologically
2012-06-15
2012-06-15T13:36:48-04:00
Joe's Search History Reveals Intentional Keylogger Research and Deployment
critical confirmed
bulk.url_searches (tracy-home), tsk.filelist (tracy-home)
2012-06-28
2012-06-28T15:41:39-04:00
LogKext Keylogger Installed on Tracy's MacBook Air
critical confirmed
email/logfile-2012-06-28-1600.eml, email/logfile-2012-06-29-1100.eml, email/logfile-2012-07-02-1200.eml
2012-06-28T15:41:39-04:00
Joe Installed LogKext Keylogger on Tracy's MacBook Air
critical confirmed
tsk.filelist (tracy-home)
2012-06-29
2012-06-29T09:04:12-04:00 — 2012-07-10T09:50:41-04:00
Financial Motive: Tracy's Tuition Crisis Drove Insider Theft
high confirmed
email/logfile-2012-06-29-1100.eml, email/logfile-2012-07-02-1200.eml, email/logfile-2012-07-06-1100.eml, bulk.url_searches (tracy-home)
2012-07-06
2012-07-06T11:49:31-04:00
Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" Email
high confirmed
bulk.rfc822 (carry-tablet), bulk.email (carry-tablet), bulk.email (tracy-home)
2012-07-06T14:12:26Z — 2012-07-10T15:15:30Z
NGDC Interior Network Traffic Shows Webmail Access During Work Hours
medium inference
pcap.http (interior-2012-07-10), pcap.tls (interior-2012-07-10), pcap.http (interior-2012-07-06)
2012-07-09
2012-07-09T09:22:10-04:00 — 2012-07-09T13:01:52-04:00
Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
critical confirmed
email/logfile-2012-07-09-1300.eml, email/logfile-2012-07-10-1000.eml, email/logfile-2012-07-02-1500.eml, email/logfile-2012-07-02-1200.eml, email/logfile-2012-06-29-1100.eml
2012-07-09T09:22:10-04:00
Stolen NGDC Documents Found on Tracy's External Drive
critical confirmed
tsk.filelist (tracy-external), tsk.filelist (tracy-home)
2012-07-09T10:22:17-07:00
Coral Forwarded Stolen NGDC Documents to Perry Patsum
critical confirmed
bulk.rfc822 (carry-tablet), bulk.email (carry-tablet), bulk.email (tracy-home)
2012-07-09T13:01:52-04:00
Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject "things"
critical confirmed
bulk.email (tracy-home), tsk.filelist (tracy-home), tsk.filelist (tracy-external)
2012-07-10
2012-07-10T09:15:54-04:00
Tracy Facilitated Unauthorized Physical Access for Coral/Carry
high inference
email/logfile-2012-07-10-1000.eml

Findings

12 findings across 18 evidence sources
▶ critical confirmed LogKext Keylogger Installed on Tracy's MacBook Air

A kernel-level keylogger (LogKext) is running as root on Tracy's MacBook Air (Tracys-MacBook-Air.local). The keylogger captures all keystrokes from users 'tracysumtwelve' and 'terrysumtwelve'. Logs are automatically emailed via Postfix (running as root, userid 0) to joe.sum.twelve@gmail.com with subject "Logfile" at regular intervals. First observed daemon startup: "LogKext Daemon starting up : Thu Jun 28 15:41:39 2012". The emails originate from the MacBook Air's IPv6 addresses on the 2600:1003::/32 prefix. This represents unauthorized surveillance of Tracy and her daughter Terry.

Key evidence from email headers:
- From: root@Tracys-MacBook-Air.local (System Administrator)
- To: joe.sum.twelve@gmail.com
- Subject: Logfile
- Sent via Postfix from userid 0 (root)

Evidence strength:
3 refs
Related: Tracy Exfiltrated Confidential NGDC Stamp... Financial Motive: Tracy's Tuition Crisis Drove...
email/logfile-2012-06-28-1600.emlemail/logfile-2012-06-29-1100.emlemail/logfile-2012-07-02-1200.eml
T1056.001

Evidence Chain

tc_38c3eb1c read_evidence_file 3ms
tc_4d0e371b read_evidence_file 3ms
tc_63ef6a7d read_evidence_file 2ms
Time: 2012-06-28T15:41:39-04:00
Sources: email/logfile-2012-06-28-1600.eml, email/logfile-2012-06-29-1100.eml, email/logfile-2012-07-02-1200.eml
Evidence Refs: tc_38c3eb1c, tc_4d0e371b, tc_63ef6a7d
ATT&CK: T1056.001
▶ critical confirmed Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents

Keylogger data shows Tracy (tracysumtwelve) created an encrypted ZIP file of confidential documents related to a rare stamp collection exhibit at the National Gallery DC (NGDC) on July 9, 2012. The keystrokes captured show:

Terminal commands typed:

ls
cd Documents
ls
zip -e documents.zip Sta[mps] Ins[urance]

Password used for encryption: "Hercules" (typed twice for confirmation)

Tracy then emailed the encrypted documents to coralbluetwo@hotmail.com (Coral/Perry) with the message: "Hey Perry, here are those documents I talked to you about. The password is your old dog's name." - confirming the ZIP password is "Hercules" (Perry/Coral's old dog's name).

Earlier keylogger entries show Tracy and Coral/Perry discussing finding valuable items at NGDC to exploit for financial gain. Tracy mentioned a rare stamp collection coming to the gallery and called it "our ticket."

Evidence strength:
5 refs
Related: LogKext Keylogger Installed on Tracy's MacBook Air Financial Motive: Tracy's Tuition Crisis Drove... Tracy Facilitated Unauthorized Physical Access...
email/logfile-2012-07-09-1300.emlemail/logfile-2012-07-10-1000.emlemail/logfile-2012-07-02-1500.emlemail/logfile-2012-07-02-1200.emlemail/logfile-2012-06-29-1100.eml
T1560.001T1048.002

Evidence Chain

tc_0b62886e read_evidence_file 10ms
tc_c97f423a read_evidence_file 9ms
tc_9aeda5b6 read_evidence_file 3ms
tc_63ef6a7d read_evidence_file 2ms
tc_4d0e371b read_evidence_file 3ms
Time: 2012-07-09T09:22:10-04:00 — 2012-07-09T13:01:52-04:00
Sources: email/logfile-2012-07-09-1300.eml, email/logfile-2012-07-10-1000.eml, email/logfile-2012-07-02-1500.eml, email/logfile-2012-07-02-1200.eml, email/logfile-2012-06-29-1100.eml
Evidence Refs: tc_0b62886e, tc_c97f423a, tc_9aeda5b6, tc_63ef6a7d, tc_4d0e371b
▶ critical confirmed Stolen NGDC Documents Found on Tracy's External Drive

Tracy's external USB drive (exFAT, volume "External") contains a directory "NGDC things" with confidential National Gallery DC documents:
- Stamp insurance 1.pdf (inode 268646403)
- Stamp Insurance 2.pdf (inode 268646407)
- Stamp insurance 3.pdf (inode 268646411)
- securityrotation.pdf (inode 268646415) — security guard rotation schedule
- NGDC_blank.doc (inode 268646419) — blank NGDC letterhead template

Additionally, deleted copies of these files exist at the root level of the drive (inodes 3108, 3112, 3116, 3120, marked with * in fls output), along with a deleted "NGDC letterhead" directory (inode 3124). This indicates Tracy first copied files to the drive root, then reorganized them into the "NGDC things" folder.

The securityrotation.pdf is particularly concerning as it would reveal when security guards change shifts — critical intelligence for planning a physical theft of the stamp collection.

Evidence strength:
3 refs
Related: VM.vmdk Virtual Machine on Tracy's External Drive
tsk.filelist (tracy-external)tsk.filelist (tracy-home)
T1005T1052.001

Evidence Chain

tc_13854cb7 run_fls 26305ms
tc_bfc3e8d3 search 20ms
tc_21776942 search 13ms
Time: 2012-07-09T09:22:10-04:00
Sources: tsk.filelist (tracy-external), tsk.filelist (tracy-home)
Evidence Refs: tc_13854cb7, tc_bfc3e8d3, tc_21776942
ATT&CK: T1005, T1052.001
▶ critical confirmed Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject "things"

Bulk extractor recovered email metadata from Tracy's MacBook Air showing an email sent from tracysumtwelve@gmail.com to coralbluetwo@hotmail.com with subject "things" and attachment "public.zip". The email is stored in the Sent Messages mbox at:
Users/tracysumtwelve/Library/Mail/V2/IMAP-tracysumtwelve@imap.gmail.com/Sent Messages.mbox/

The attachment contained a "docs" directory with the stamp insurance PDFs. There are also draft versions of this email found at the Drafts location, suggesting Tracy composed it before sending.

Additionally, documents.zip was found in Tracy's Trash (inode 430246), along with "Stamp insurance 1 2.pdf" and "Stamp insurance 1.pdf.zip" — evidence of Tracy cleaning up after exfiltration. The original documents exist in Users/tracysumtwelve/Documents/docs/ and Users/tracysumtwelve/Documents/docs 2/.

The keylogger confirms the ZIP password is "Hercules" (Perry/Coral's old dog's name).

Evidence strength:
4 refs
Related: Joe Installed LogKext Keylogger on Tracy's MacBook Air Coral Forwarded Stolen NGDC Documents to Perry Patsum
bulk.email (tracy-home)tsk.filelist (tracy-home)tsk.filelist (tracy-external)
T1048.002T1560.001T1070.004

Evidence Chain

tc_f7ca6c35 run_bulk_extractor 474437ms
tc_06434451 run_fls 267240ms
tc_721e9acb search 12ms
tc_5897fdab search 440ms
Time: 2012-07-09T13:01:52-04:00
Sources: bulk.email (tracy-home), tsk.filelist (tracy-home), tsk.filelist (tracy-external)
Evidence Refs: tc_f7ca6c35, tc_06434451, tc_721e9acb, tc_5897fdab
▶ critical confirmed Joe Installed LogKext Keylogger on Tracy's MacBook Air

Joe (joesumtwelve) installed the LogKext kernel-level keylogger on Tracy's MacBook Air. Evidence:

  1. Deleted user account: Users/joesumtwelve (Deleted) — Joe had an active user account on the MacBook Air that was subsequently deleted to cover tracks.

  2. Browser history showing research: Joe's Safari cache contains search history for "logkext minmeg" at:
    Users/joesumtwelve (Deleted)/Library/Caches/Metadata/Safari/History/

  3. Full LogKext installation found on the system:

  4. System/Library/Extensions/logKext.kext/ (kernel extension)
  5. Library/LaunchDaemons/logKext.plist (persistence via LaunchDaemon)
  6. Library/Application Support/logKext/ (support files including logKextKeyGen, logKextKeymap.plist)
  7. private/var/root/Library/Preferences/com.fsb.logKext.plist (configuration)

  8. Installation receipts at private/var/db/receipts/com.fsb.logkext.*.pkg (logkext, logkextclient, logkextdaemon, logkextExt, logkextkeygen, logkextkeymap, logkextReadme, logkextuninstall)

  9. Automated exfiltration: Keylogger configured to email logs via Postfix (root) to joe.sum.twelve@gmail.com every ~3 hours.

Joe likely installed the keylogger to monitor Tracy's activities, possibly related to their personal/divorce situation (divorcerates.doc found in Tracy's Documents).

Evidence strength:
2 refs
Related: Tracy Emailed Stolen Documents to Coral... Joe's Search History Reveals Intentional...
tsk.filelist (tracy-home)
T1056.001T1547.006T1070.004

Evidence Chain

tc_3ca44269 search 34ms
tc_06434451 run_fls 267240ms
Time: 2012-06-28T15:41:39-04:00
Sources: tsk.filelist (tracy-home)
Evidence Refs: tc_3ca44269, tc_06434451
▶ critical confirmed Coral Forwarded Stolen NGDC Documents to Perry Patsum

Within minutes of receiving the stolen NGDC documents from Tracy, Coral (coralbluetwo@hotmail.com) forwarded them to Perry Patsum (perrypatsum@yahoo.com) with subject "Some things for you."

Email recovered from Carry's tablet (which contains Coral's Thunderbird email client configuration):
- From: Coral coralbluetwo@hotmail.com
- To: Perry Patsum perrypatsum@yahoo.com
- Subject: Some things for you
- Date: Mon, 09 Jul 2012 10:22:17 -0700 (1:22 PM EDT)
- Message-ID: 4FFB1349.70506@hotmail.com

Timeline:
1. Tracy created encrypted ZIP of stamp insurance documents on MacBook Air ~9:22 AM EDT on July 9
2. Tracy emailed the ZIP to coralbluetwo@hotmail.com with subject "things" ~1:01 PM EDT
3. Coral forwarded to Perry Patsum at 1:22 PM EDT — approximately 20 minutes later

This confirms a three-person conspiracy: Tracy (insider at NGDC) → Coral/Carry (intermediary) → Perry Patsum (end recipient). The stolen documents include stamp insurance valuations and security guard rotation schedules.

Evidence strength:
3 refs
Related: Tracy Emailed Stolen Documents to Coral... Wider Conspiracy Network: Pat, King,...
bulk.rfc822 (carry-tablet)bulk.email (carry-tablet)bulk.email (tracy-home)
T1048.002

Evidence Chain

tc_961897f8 search 18ms
tc_9e443fdd run_bulk_extractor 480779ms
tc_721e9acb search 12ms
Time: 2012-07-09T10:22:17-07:00
Sources: bulk.rfc822 (carry-tablet), bulk.email (carry-tablet), bulk.email (tracy-home)
Evidence Refs: tc_961897f8, tc_9e443fdd, tc_721e9acb
ATT&CK: T1048.002
▶ critical confirmed Joe's Search History Reveals Intentional Keylogger Research and Deployment

Search history recovered from Tracy's MacBook Air (from Joe's deleted user account and system-wide browser caches) shows extensive research into the LogKext keylogger:

  1. "what does minmeg do logkext" — searched 66 times (most frequent query on the system)
  2. "logkext minmeg" — searched 36 times
  3. "what does minimum megs do logkext" — searched 24 times
  4. "logkext" — searched 7 times
  5. Multiple cached pages from logkext.googlecode.com (source code review)
  6. Visited logKextClient.cpp source code directly

Most critically:
- "is it ok to keylog children" — searched 7 times, showing Joe was aware of the legal/ethical implications and was also monitoring his daughter Terry
- "mac mail and crontab daughter" — Joe set up automated emailing of keylogger data via crontab

Other searches of interest:
- "Prufrock Preparatory tuition" — Terry's school, showing Joe's concern about tuition costs (matching Tracy's conversations)
- "buick" — appears in multiple searches

Joe clearly planned, researched, installed, and configured the LogKext keylogger to monitor both Tracy and their daughter Terry on the shared MacBook Air, then configured Postfix/crontab to automatically email the logs to joe.sum.twelve@gmail.com.

Evidence strength:
2 refs
Related: Joe Installed LogKext Keylogger on Tracy's MacBook Air Financial Motive: Tracy's Tuition Crisis Drove...
bulk.url_searches (tracy-home)tsk.filelist (tracy-home)
T1056.001T1547.006T1053.003

Evidence Chain

tc_6417e74e search 35ms
tc_3ca44269 search 34ms
Time: 2012-06-15T13:36:48-04:00
Sources: bulk.url_searches (tracy-home), tsk.filelist (tracy-home)
Evidence Refs: tc_6417e74e, tc_3ca44269
▶ high inference Tracy Facilitated Unauthorized Physical Access for Coral/Carry

Keylogger data from July 10, 2012 shows Tracy offering to help someone (likely Coral/Carry) bring a tablet device past NGDC security and gain access to view exhibits:

"I can definitely help get your tablet in. Our security guards can be pretty ridiculous sometimes! When would you want to get in and take a look around?"

This suggests Tracy is facilitating unauthorized or improperly authorized physical access to the gallery for her co-conspirator to case the stamp exhibit. Combined with the document exfiltration, this indicates planning for potential theft of the rare stamp collection.

Evidence strength:
1 ref
Related: Tracy Exfiltrated Confidential NGDC Stamp...
email/logfile-2012-07-10-1000.eml
T1200

Evidence Chain

tc_c97f423a read_evidence_file 9ms
Time: 2012-07-10T09:15:54-04:00
Sources: email/logfile-2012-07-10-1000.eml
Evidence Refs: tc_c97f423a
ATT&CK: T1200
▶ high confirmed Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" Email

An email recovered from Carry's tablet reveals a wider conspiracy network beyond Tracy and Coral:

Email details:
- From: Pat TeeSumTwelve patsumtwelve@gmail.com
- To: throne1966@hotmail.com (addressed as "King")
- CC: coralbluetwo@hotmail.com (Coral/Carry)
- Subject: "can't pass up"
- Date: Fri, 6 Jul 2012 11:49:31 -0400

This email, with subject "can't pass up," was sent just days before Tracy exfiltrated the stamp insurance documents (July 9). It establishes that Pat, King, and Coral/Carry were communicating about an opportunity that was too good to pass up — consistent with the stamp exhibit theft conspiracy.

Keylogger data also shows Tracy typed "throne1966@hotmail.com...King, first..." — indicating Tracy was also in contact with King.

Identity network:
- Tracy Sumtwelve (tracysumtwelve@gmail.com) — NGDC insider
- Carry "Coral" Carsumtwotwelve (cat2welve@gmail.com, coralbluetwo@hotmail.com) — intermediary
- Pat TeeSumTwelve (patsumtwelve@gmail.com) — conspirator, possibly Tracy's relative
- Perry Patsum (perrypatsum@yahoo.com) — received forwarded documents from Coral
- "King" (throne1966@hotmail.com) — recipient of "can't pass up" email

Evidence strength:
3 refs
Related: Coral Forwarded Stolen NGDC Documents to Perry Patsum
bulk.rfc822 (carry-tablet)bulk.email (carry-tablet)bulk.email (tracy-home)
T1048.002

Evidence Chain

tc_405b2871 search 27ms
tc_146dd7d9 search 16ms
tc_9e443fdd run_bulk_extractor 480779ms
Time: 2012-07-06T11:49:31-04:00
Sources: bulk.rfc822 (carry-tablet), bulk.email (carry-tablet), bulk.email (tracy-home)
Evidence Refs: tc_405b2871, tc_146dd7d9, tc_9e443fdd
ATT&CK: T1048.002
▶ high confirmed Financial Motive: Tracy's Tuition Crisis Drove Insider Theft

Multiple evidence sources establish Tracy's financial desperation as the motive for the NGDC document theft:

  1. Keylogger captured searches: "private school tuition help", "financial advisor washington dc", "private school financial aid", "best alternative to private school"
  2. Email to Joe: Tracy emailed joe.sum.twelve@gmail.com asking for help with Terry's tuition at Prufrock Preparatory: "is there any way you would be willing to help me out with her tuition for this year?"
  3. divorcerates.doc: Found in Tracy's Documents folder, suggesting ongoing divorce proceedings
  4. Keylogger email (June 29): Tracy wrote to Coral: "If anything comes up around the office that we can maybe... get in on... please lets try to do so. Kiddo is getting really bent out of shape about possibly having to switch schools."
  5. July 2 keylogger: Tracy called the stamp exhibit "our ticket" after learning about its value
  6. Terry's own awareness: Terry (terrysumtwelve) searched "how to help your parents with private school" and "help parents afford private school"

The financial pressure from private school tuition and divorce costs directly motivated Tracy to steal confidential NGDC documents about the valuable stamp exhibit.

Evidence strength:
4 refs
Related: LogKext Keylogger Installed on Tracy's MacBook Air Tracy Exfiltrated Confidential NGDC Stamp... Joe's Search History Reveals Intentional...
email/logfile-2012-06-29-1100.emlemail/logfile-2012-07-02-1200.emlemail/logfile-2012-07-06-1100.emlbulk.url_searches (tracy-home)

Evidence Chain

tc_4d0e371b read_evidence_file 3ms
tc_63ef6a7d read_evidence_file 2ms
tc_d595d352 read_evidence_file 11ms
tc_6417e74e search 35ms
Time: 2012-06-29T09:04:12-04:00 — 2012-07-10T09:50:41-04:00
Sources: email/logfile-2012-06-29-1100.eml, email/logfile-2012-07-02-1200.eml, email/logfile-2012-07-06-1100.eml, bulk.url_searches (tracy-home)
Evidence Refs: tc_4d0e371b, tc_63ef6a7d, tc_d595d352, tc_6417e74e
▶ medium inference VM.vmdk Virtual Machine on Tracy's External Drive

Tracy's external USB drive contains a VM.vmdk (virtual machine disk) at the root level alongside the stolen NGDC documents. The presence of a virtual machine on a portable drive used for transporting stolen documents between home and work raises concerns about:
1. Potential use for covert activities that leave no trace on the host OS
2. Possible encryption or additional document staging
3. Bypassing workplace security monitoring

The VM.vmdk file coexists with the "NGDC things" directory containing stolen stamp insurance documents and security rotation schedules. The external drive (exFAT formatted, volume "External") was used to transport data between Tracy's home computer and work computer according to the evidence README.

Evidence strength:
2 refs
Related: Stolen NGDC Documents Found on Tracy's External Drive
tsk.filelist (tracy-external)
T1564.006

Evidence Chain

tc_4dbd286c list_files 999ms
tc_13854cb7 run_fls 26305ms
Sources: tsk.filelist (tracy-external)
Evidence Refs: tc_4dbd286c, tc_13854cb7
ATT&CK: T1564.006
▶ medium inference NGDC Interior Network Traffic Shows Webmail Access During Work Hours

Network packet captures from the NGDC interior network (SSL-stripping middleman) captured on July 6, 9, and 10 reveal workstation activity:

  1. 192.168.1.101 (interior IP, maps to 10.10.1.169 exterior):
  2. Accessed mail.google.com on July 10 at 15:13:00 UTC (11:13 AM EDT)
  3. Connected to outlook.com (pod51018.outlook.com) on July 10 at 15:12:45 UTC
  4. Browsed www.louvre.fr and Wikipedia's Palais du Louvre article on July 6

  5. Searched Google for "gmail" on July 10

  6. 192.168.1.100 (separate workstation):

  7. Windows Update traffic
  8. Microsoft Watson error reporting (ASUSTeK EB1012P)

The combination of Gmail and Outlook/Hotmail access from the same workstation during work hours is consistent with Tracy accessing both her personal Gmail (tracysumtwelve@gmail.com) and potentially Coral's Hotmail (coralbluetwo@hotmail.com) to coordinate the document exfiltration. The Louvre browsing suggests research into museum operations.

Evidence strength:
3 refs
pcap.http (interior-2012-07-10)pcap.tls (interior-2012-07-10)pcap.http (interior-2012-07-06)

Evidence Chain

tc_68dab365 search 472ms
tc_94445a32 run_pcap_analysis 5136ms
tc_360b6a0d run_pcap_analysis 8394ms
Time: 2012-07-06T14:12:26Z — 2012-07-10T15:15:30Z
Sources: pcap.http (interior-2012-07-10), pcap.tls (interior-2012-07-10), pcap.http (interior-2012-07-06)
Evidence Refs: tc_68dab365, tc_94445a32, tc_360b6a0d
✓ Ruled Out (Negative Findings)

These hypotheses were explicitly tested and no supporting evidence was found.

  • No Evidence of Second Independent Attack Narrative
    After thoroughly analyzing all evidence sources, no evidence of a second independent attack narrative was found beyond the two identified incidents (insider theft and keylogger surveillance). Counter-hypotheses tested: 1. **User account audit**: All unique accounts found (tracysumtwelve,...

MITRE ATT&CK Coverage

10 techniques identified across findings
0
Techniques
0
Tactics
0
Findings Mapped
Reconnaissance
▶
Resource Development
▶
Initial Access1
▶
Execution1
▶
Persistence2
▶
Privilege Escalation2
▶
Defense Evasion2
▶
Credential Access1
▶
Discovery
▶
Lateral Movement
▶
Collection3
▶
Command and Control
▶
Exfiltration2
▶
Impact
▶
Inhibit Response Function
▶
Evasion
▶
Impair Process Control
Initial Access
1T / 1F
T1200
Hardware Additions
1 finding
Tracy Facilitated Unauthorized Physical Access for Coral/Carry
Execution
1T / 1F
T1053.003
Cron
1 finding
Joe's Search History Reveals Intentional Keylogger...
Persistence
2T / 3F
T1053.003
Cron
1 finding
Joe's Search History Reveals Intentional Keylogger...
T1547.006
Kernel Modules and Extensions
2 findings
Joe Installed LogKext Keylogger on Tracy's MacBook Air
Joe's Search History Reveals Intentional Keylogger...
Privilege Escalation
2T / 3F
T1053.003
Cron
1 finding
Joe's Search History Reveals Intentional Keylogger...
T1547.006
Kernel Modules and Extensions
2 findings
Joe Installed LogKext Keylogger on Tracy's MacBook Air
Joe's Search History Reveals Intentional Keylogger...
Defense Evasion
2T / 3F
T1070.004
File Deletion
2 findings
Tracy Emailed Stolen Documents to Coral...
Joe Installed LogKext Keylogger on Tracy's MacBook Air
T1564.006
Run Virtual Instance
1 finding
VM.vmdk Virtual Machine on Tracy's External Drive
Credential Access
1T / 3F
T1056.001
Keylogging
3 findings
LogKext Keylogger Installed on Tracy's MacBook Air
Joe Installed LogKext Keylogger on Tracy's MacBook Air
Joe's Search History Reveals Intentional Keylogger...
Collection
3T / 6F
T1005
Data from Local System
1 finding
Stolen NGDC Documents Found on Tracy's External Drive
T1056.001
Keylogging
3 findings
LogKext Keylogger Installed on Tracy's MacBook Air
Joe Installed LogKext Keylogger on Tracy's MacBook Air
Joe's Search History Reveals Intentional Keylogger...
T1560.001
Archive via Utility
2 findings
Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
Tracy Emailed Stolen Documents to Coral...
Exfiltration
2T / 5F
T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
4 findings
Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
Tracy Emailed Stolen Documents to Coral...
Coral Forwarded Stolen NGDC Documents to Perry Patsum
Wider Conspiracy Network: Pat, King, Coral/Carry...
T1052.001
Exfiltration over USB
1 finding
Stolen NGDC Documents Found on Tracy's External Drive

Indicators of Compromise

Extracted from finding descriptions
0
Total IOCs
0
External IPs
0
File IOCs
0
Emails
Network IOCs (3)
TypeValueContextActions
Internal IP 192.168.1.101 NGDC Interior Network Traffic Shows Webmail Access During Work Hours VT
Internal IP 10.10.1.169 NGDC Interior Network Traffic Shows Webmail Access During Work Hours VT
Internal IP 192.168.1.100 NGDC Interior Network Traffic Shows Webmail Access During Work Hours VT
File IOCs (2)
TypeValueContextActions
Path /var/root/Library/Preferences/com.fsb.logKext.plist Joe Installed LogKext Keylogger on Tracy's MacBook Air
Path /var/db/receipts/com.fsb.logkext Joe Installed LogKext Keylogger on Tracy's MacBook Air
Email IOCs (11)
TypeValueContextActions
Email joe.sum.twelve@gmail.com LogKext Keylogger Installed on Tracy's MacBook Air
Email root@tracys-macbook-air.local LogKext Keylogger Installed on Tracy's MacBook Air
Email coralbluetwo@hotmail.com Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents
Email tracysumtwelve@gmail.com Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject
Email imap-tracysumtwelve@imap.gmail.com Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject
Email perrypatsum@yahoo.com Coral Forwarded Stolen NGDC Documents to Perry Patsum
Email 4ffb1349.70506@hotmail.com Coral Forwarded Stolen NGDC Documents to Perry Patsum
Email patsumtwelve@gmail.com Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" E
Email throne1966@hotmail.com Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" E
Email throne1966@hotmail.com...king Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" E
Email cat2welve@gmail.com Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" E

Evidence Browser

Browse raw extracted evidence analyzed during the investigation
Select a source
Select a source from the tree to view raw evidence output.

Evidence Sources

99 ingested sources from /evidence/ngdc
Source Name Extractor Lines Hash Referenced By
tsk.partitions sleuthkit 12 sha256:3eeed0fab... —
tsk.partitions sleuthkit 16 sha256:32fd52da0... —
tsk.fsstat sleuthkit 36 sha256:91fd4b9ac... —
tsk.fsstat sleuthkit 35 sha256:a6b7c56d1... —
pcap.summary tshark 80 sha256:1c8484ff3... —
pcap.summary tshark 83 sha256:42804ca52... —
pcap.conversations tshark 99 sha256:db87569d2... —
pcap.http tshark 11 sha256:6238d74b4... —
pcap.conversations tshark 394 sha256:6fb3f95f3... —
pcap.tls tshark 5 sha256:2c21ab3b6... —
pcap.http tshark 907 sha256:d019664a4... —
pcap.beaconing tshark 9 sha256:e706424f4... —
pcap.tls tshark 34 sha256:909ecc3af... —
pcap.tunneling tshark 8 sha256:c61ec8cf5... —
pcap.beaconing tshark 5 sha256:551238625... —
pcap.tunneling tshark 20 sha256:b5ec9977a... —
tsk.filelist sleuthkit 152 sha256:47c17075c... —
tsk.filelist sleuthkit 344147 sha256:0ce797592... —
bulk.domain bulk_extractor 165507 sha256:00c59cc15... —
bulk.email bulk_extractor 10272 sha256:3a493651c... —
bulk.ether bulk_extractor 529 sha256:73a63a84b... —
bulk.exif bulk_extractor 2181 sha256:908bad7f3... —
bulk.gps bulk_extractor 9 sha256:d138575f3... —
bulk.ip bulk_extractor 11 sha256:6e55edaad... —
bulk.packets bulk_extractor 22 sha256:6ae70d3c4... —
bulk.rfc822 bulk_extractor 27777 sha256:051a3b46e... —
bulk.tcp bulk_extractor 7 sha256:6bc40d8b0... —
bulk.url bulk_extractor 152208 sha256:ef4e982ab... —
bulk.domain bulk_extractor 23464 sha256:7c039841a... —
bulk.url_facebook-address bulk_extractor 47 sha256:6d1c45302... —
bulk.email bulk_extractor 4838 sha256:1a94329df... —
bulk.url_facebook-id bulk_extractor 9 sha256:87211fa99... —
bulk.ether bulk_extractor 97 sha256:c5146ff90... —
bulk.url_searches bulk_extractor 190 sha256:f66086492... —
bulk.exif bulk_extractor 269 sha256:831598e57... —
bulk.url_services bulk_extractor 3160 sha256:3b7100d9c... —
bulk.httplogs bulk_extractor 6 sha256:40aa4ca9a... —
bulk.rfc822 bulk_extractor 1098 sha256:640978e23... —
bulk.url bulk_extractor 19326 sha256:15a698332... —
bulk.url_facebook-address bulk_extractor 9 sha256:06f1812f2... —
bulk.url_searches bulk_extractor 17 sha256:b1a342f28... —
bulk.url_services bulk_extractor 1126 sha256:c476c5f18... —
pcap.summary tshark 82 sha256:f070dcaea... —
pcap.summary tshark 86 sha256:18efb5c95... —
pcap.summary tshark 86 sha256:d6b120795... —
pcap.summary tshark 84 sha256:89bc42d0f... —
pcap.conversations tshark 157 sha256:1c7a819f9... —
pcap.conversations tshark 408 sha256:90f953281... —
pcap.conversations tshark 153 sha256:1b1d52d57... —
pcap.http tshark 112 sha256:ca78bcdf0... —
pcap.conversations tshark 321 sha256:cfd185cd9... —
pcap.http tshark 1281 sha256:e8eb1b78e... —
pcap.http tshark 148 sha256:2bdbbb4ce... —
pcap.tls tshark 9 sha256:cf22fcb65... —
pcap.http tshark 921 sha256:49fe8ba41... —
pcap.tls tshark 47 sha256:0348e35af... —
pcap.beaconing tshark 13 sha256:4fee3b5b0... —
pcap.tls tshark 27 sha256:643111703... —
pcap.beaconing tshark 9 sha256:c5e0fd510... —
pcap.beaconing tshark 5 sha256:5ce75c915... —
pcap.tls tshark 53 sha256:1ed0dd6d5... —
pcap.tunneling tshark 11 sha256:5773b77b8... —
pcap.beaconing tshark 5 sha256:552bdecf7... —
pcap.tunneling tshark 17 sha256:8b3b1abba... —
pcap.tunneling tshark 20 sha256:64c5364ba... —
pcap.tunneling tshark 23 sha256:0320e4e88... —
bulk.domain bulk_extractor 197541 sha256:0bdfe2712... —
bulk.email bulk_extractor 4869 sha256:9ac38bf22... —
bulk.ether bulk_extractor 6 sha256:99ff5920f... —
bulk.exif bulk_extractor 611 sha256:c7ddf55e8... —
bulk.ip bulk_extractor 37 sha256:8affa477e... —
bulk.packets bulk_extractor 99 sha256:804a4e11f... —
bulk.rfc822 bulk_extractor 2417 sha256:6497a5017... —
bulk.tcp bulk_extractor 16 sha256:ecbd2a169... —
bulk.url bulk_extractor 244001 sha256:b6eb3d4bc... —
bulk.url_facebook-address bulk_extractor 8 sha256:09dd72b4c... —
bulk.url_searches bulk_extractor 44 sha256:fdbbb7bed... —
bulk.url_services bulk_extractor 2518 sha256:c381a5e90... —
bulk.domain bulk_extractor 19008 sha256:57f713bd4... —
bulk.email bulk_extractor 3181 sha256:9ab35408b... —
bulk.ether bulk_extractor 213 sha256:66f948919... —
bulk.exif bulk_extractor 35 sha256:39d2ff33e... —
bulk.httplogs bulk_extractor 6 sha256:9845dc366... —
bulk.rfc822 bulk_extractor 108 sha256:77d7a38f1... —
bulk.url bulk_extractor 15399 sha256:0dd8d4bd6... —
bulk.url_facebook-address bulk_extractor 13 sha256:6c45bca5b... —
bulk.url_searches bulk_extractor 12 sha256:94f75c50f... —
bulk.url_services bulk_extractor 848 sha256:fc97bdb62... —
bulk.domain bulk_extractor 145768 sha256:86b4dbf6a... —
bulk.email bulk_extractor 48884 sha256:ef911ab24... —
bulk.ether bulk_extractor 5565 sha256:6c58f710f... —
bulk.exif bulk_extractor 392 sha256:dad6aa61d... —
bulk.gps bulk_extractor 48 sha256:f9d11fa5a... —
bulk.rfc822 bulk_extractor 1340 sha256:4b15b01c8... —
bulk.url bulk_extractor 92280 sha256:386a71c27... —
bulk.url_facebook-address bulk_extractor 12 sha256:a40ac0145... —
bulk.url_facebook-id bulk_extractor 7 sha256:ffcf7444c... —
bulk.url_searches bulk_extractor 34 sha256:0f888fbb4... —
bulk.url_services bulk_extractor 1525 sha256:0e9ea07b3... —

Investigation Performance

Tool usage, processing time, and token estimates
0
Tool Calls
0
Unique Tools
2275.7s
Processing Time
~21k
Est. Tokens
Tool Distribution
Token Breakdown
Input Tokens (est.)3,880
Output Tokens (est.)16,727
Total Tokens (est.)20,607
Activity Sparkline
Avg Processing Time by Tool
search
0.1s avg · 38x
read_evidence_file
0.0s avg · 22x
list_directory
0.0s avg · 15x
submit_finding
0.2s avg · 13x
get_raw_output
0.4s avg · 6x
run_pcap_analysis
4.7s avg · 6x
run_mmls
0.1s avg · 5x
run_bulk_extractor
381.2s avg · 5x
find_defense_evasion._search(all)
0.0s avg · 5x
run_fls
73.4s avg · 4x
extract_file_by_inode
0.1s avg · 4x
check_extraction_status
0.0s avg · 3x
get_completed_results
0.0s avg · 3x
find_persistence_mechanisms._search(all)
0.0s avg · 3x
run_fsstat
0.1s avg · 2x
start_extraction_batch
0.0s avg · 2x
correlate_across_sources
4.2s avg · 2x
parse_browser_history
6.3s avg · 1x
parse_plist
2.0s avg · 1x
list_files
1.0s avg · 1x
find_execution_evidence
0.0s avg · 1x
find_defense_evasion
0.1s avg · 1x
find_persistence_mechanisms._query(registry.system)
0.3s avg · 1x
find_persistence_mechanisms._query(registry.software)
0.0s avg · 1x
find_persistence_mechanisms._query(volatility.svcscan)
0.0s avg · 1x
find_persistence_mechanisms._query(tsk.filelist)
1.1s avg · 1x
find_persistence_mechanisms
1.6s avg · 1x
find_data_exfiltration_indicators._query(bulk.url)
2.4s avg · 1x
find_data_exfiltration_indicators._query(bulk.email)
0.2s avg · 1x
find_data_exfiltration_indicators._query(bulk.domain)
1.0s avg · 1x
find_data_exfiltration_indicators._search(all)
0.0s avg · 1x
find_data_exfiltration_indicators._query(pcap.http)
0.1s avg · 1x
find_data_exfiltration_indicators
4.8s avg · 1x
assess_recovery._query(tsk.filelist)
1.0s avg · 1x
assess_recovery
1.1s avg · 1x
audit_evidence_coverage
6.1s avg · 1x
audit_tool_coverage
0.0s avg · 1x
submit_narrative
0.0s avg · 1x
Top Longest Operations
ToolDurationParams
run_bulk_extractor 771.8s {"features": null, "image_path":...
run_bulk_extractor 480.8s {"features": null, "image_path":...
run_bulk_extractor 474.4s {"features": null, "image_path":...
run_fls 267.2s {"image_path": "/evidence/ngdc/tracy-home/tracy-home-2012-07-16-final.E01",...
run_bulk_extractor 118.3s {"features": null, "image_path":...
run_bulk_extractor 60.6s {"features": null, "image_path":...
run_fls 26.3s {"image_path":...
run_pcap_analysis 8.4s {"display_filter": null, "max_packets": 10000, "mode": "all", "pcap_path":...
parse_browser_history 6.3s {}
audit_evidence_coverage 6.1s {}

Audit Trail

Complete provenance chain from evidence to findings
ID Tool Duration Timestamp Actions
tc_4d9062cf read_evidence_file 0ms 2026-04-20T13:47:41
tc_05b62981 list_directory 2ms 2026-04-20T13:47:48
tc_86daca85 list_directory 5ms 2026-04-20T13:47:48
tc_21d34b2a list_directory 4ms 2026-04-20T13:47:57
tc_d49377d3 list_directory 4ms 2026-04-20T13:47:57
tc_134cfdbc list_directory 1ms 2026-04-20T13:47:57
tc_6271fa7e list_directory 2ms 2026-04-20T13:47:58
tc_126588de list_directory 5ms 2026-04-20T13:47:58
tc_6a443b52 list_directory 6ms 2026-04-20T13:47:58
tc_fe4f71c8 list_directory 4ms 2026-04-20T13:47:58
tc_942fa040 read_evidence_file 1ms 2026-04-20T13:47:58
tc_85b1398b read_evidence_file 3ms 2026-04-20T13:48:13
tc_7a785f06 read_evidence_file 5ms 2026-04-20T13:48:13
tc_2433e4e1 read_evidence_file 3ms 2026-04-20T13:48:13
tc_a789adf4 read_evidence_file 7ms 2026-04-20T13:48:13
tc_22a75925 read_evidence_file 5ms 2026-04-20T13:48:13
tc_3c1c1cdb read_evidence_file 3ms 2026-04-20T13:48:13
tc_38c3eb1c read_evidence_file 3ms 2026-04-20T13:48:13
tc_4d0e371b read_evidence_file 3ms 2026-04-20T13:48:13
tc_9aeda5b6 read_evidence_file 3ms 2026-04-20T13:48:13
tc_11f226dc read_evidence_file 1ms 2026-04-20T13:48:13
tc_67f4dc75 read_evidence_file 1ms 2026-04-20T13:48:13
tc_63ef6a7d read_evidence_file 2ms 2026-04-20T13:48:18
tc_a3cdf6b3 read_evidence_file 2ms 2026-04-20T13:48:18
tc_8c62bffd read_evidence_file 6ms 2026-04-20T13:48:40
tc_0b62886e read_evidence_file 10ms 2026-04-20T13:48:40
tc_d595d352 read_evidence_file 11ms 2026-04-20T13:48:40
tc_c97f423a read_evidence_file 9ms 2026-04-20T13:48:40
tc_6f17d6a1 read_evidence_file 7ms 2026-04-20T13:48:40
tc_44aabbf7 read_evidence_file 8ms 2026-04-20T13:48:40
tc_09d5ea60 submit_finding 26ms 2026-04-20T13:49:51
tc_38cee15e submit_finding 11ms 2026-04-20T13:49:51
tc_f51c93eb submit_finding 9ms 2026-04-20T13:49:51
tc_556a3ec7 run_mmls 0ms 2026-04-20T13:50:03
tc_8034abe2 run_mmls 0ms 2026-04-20T13:50:04
tc_3534ed44 run_mmls 0ms 2026-04-20T13:50:04
tc_e67d2216 run_mmls 189ms 2026-04-20T13:50:04
tc_6ee1662c run_mmls 207ms 2026-04-20T13:50:04
tc_eda17aa6 get_raw_output 12ms 2026-04-20T13:50:22
tc_570d8213 list_directory 5ms 2026-04-20T13:50:22
tc_f45dfef4 list_directory 7ms 2026-04-20T13:50:22
tc_4ec1a48c list_directory 7ms 2026-04-20T13:50:22
tc_8dc56ef5 run_fsstat 89ms 2026-04-20T13:50:22
tc_753c2583 run_fsstat 107ms 2026-04-20T13:50:22
tc_0e7a0003 get_raw_output 9ms 2026-04-20T13:50:32
tc_519834d2 start_extraction_batch 10ms 2026-04-20T13:50:53
tc_b2640ff2 run_fls 0ms 2026-04-20T13:50:53
tc_812ec093 run_fls 0ms 2026-04-20T13:50:54
tc_94445a32 run_pcap_analysis 5136ms 2026-04-20T13:50:58
tc_360b6a0d run_pcap_analysis 8394ms 2026-04-20T13:51:02
tc_13854cb7 run_fls 26305ms 2026-04-20T13:51:20
tc_06434451 run_fls 267240ms 2026-04-20T13:55:21
tc_f7ca6c35 run_bulk_extractor 474437ms 2026-04-20T13:58:48
tc_9e443fdd run_bulk_extractor 480779ms 2026-04-20T13:58:54
tc_37504818 get_raw_output 731ms 2026-04-20T13:59:19
tc_f2f6fda7 get_raw_output 14ms 2026-04-20T13:59:22
tc_633a9acb list_directory 4ms 2026-04-20T13:59:22
tc_2c172fdc list_directory 5ms 2026-04-20T13:59:22
tc_1248c2d4 search 42ms 2026-04-20T13:59:35
tc_a797fc44 search 193ms 2026-04-20T13:59:35
tc_91039dfb run_pcap_analysis 3238ms 2026-04-20T13:59:39
tc_f3f1ab11 run_pcap_analysis 3570ms 2026-04-20T13:59:39
tc_71647c9a run_pcap_analysis 3759ms 2026-04-20T13:59:39
tc_b03fc0ac run_pcap_analysis 4207ms 2026-04-20T13:59:40
tc_6562c955 search 28ms 2026-04-20T13:59:52
tc_39d2ed6c search 89ms 2026-04-20T13:59:52
tc_d5eb0580 read_evidence_file 5ms 2026-04-20T13:59:52
tc_e24172b3 check_extraction_status 0ms 2026-04-20T13:59:54
tc_677fe6cf get_completed_results 0ms 2026-04-20T14:00:05
tc_6bdf99fa search 44ms 2026-04-20T14:00:05
tc_721e9acb search 12ms 2026-04-20T14:00:05
tc_5897fdab search 440ms 2026-04-20T14:00:40
tc_57a4e0d0 search 376ms 2026-04-20T14:00:40
tc_bfc3e8d3 search 20ms 2026-04-20T14:00:40
tc_21776942 search 13ms 2026-04-20T14:00:40
tc_79d581b4 submit_finding 17ms 2026-04-20T14:01:17
tc_eb4e68a6 submit_finding 13ms 2026-04-20T14:01:17
tc_3ca44269 search 34ms 2026-04-20T14:01:29
tc_d691bfff search 11ms 2026-04-20T14:01:29
tc_b882b317 search 10ms 2026-04-20T14:01:29
tc_9fc58780 search 14ms 2026-04-20T14:01:29
tc_6f9e078c submit_finding 2182ms 2026-04-20T14:02:10
tc_edfdf9a9 parse_browser_history 6285ms 2026-04-20T14:02:30
tc_2276f98a search 11ms 2026-04-20T14:02:30
tc_0a6144f9 search 16ms 2026-04-20T14:02:30
tc_1faad806 run_bulk_extractor 771797ms 2026-04-20T14:03:45
tc_5cfa23c3 parse_plist 1962ms 2026-04-20T14:03:50
tc_146dd7d9 search 16ms 2026-04-20T14:03:50
tc_99e7c505 search 380ms 2026-04-20T14:03:51
tc_0ccf2bae check_extraction_status 0ms 2026-04-20T14:03:51
tc_8d866850 get_completed_results 0ms 2026-04-20T14:04:36
tc_4dbd286c list_files 999ms 2026-04-20T14:04:37
tc_a6843c1a find_execution_evidence 43ms 2026-04-20T14:04:58
tc_765072a6 find_defense_evasion._search(all) 46ms 2026-04-20T14:04:58
tc_3889df09 find_defense_evasion._search(all) 17ms 2026-04-20T14:04:58
tc_af267cff find_defense_evasion._search(all) 15ms 2026-04-20T14:04:58
tc_0eb32c05 find_defense_evasion._search(all) 6ms 2026-04-20T14:04:58
tc_fbba248e find_defense_evasion._search(all) 13ms 2026-04-20T14:04:58
tc_f29f8156 find_defense_evasion 116ms 2026-04-20T14:04:58
tc_9278d656 find_persistence_mechanisms._query(registry.system) 266ms 2026-04-20T14:04:59
tc_d80f87a5 find_persistence_mechanisms._query(registry.software) 32ms 2026-04-20T14:04:59
tc_f97bf9e5 find_persistence_mechanisms._query(volatility.svcscan) 33ms 2026-04-20T14:04:59
tc_f6e07f15 find_persistence_mechanisms._search(all) 12ms 2026-04-20T14:04:59
tc_b03757eb find_persistence_mechanisms._search(all) 9ms 2026-04-20T14:04:59
tc_62c7accd find_persistence_mechanisms._search(all) 12ms 2026-04-20T14:04:59
tc_029b8dc2 find_persistence_mechanisms._query(tsk.filelist) 1145ms 2026-04-20T14:05:00
tc_23229197 find_persistence_mechanisms 1622ms 2026-04-20T14:05:00
tc_4657eba3 find_data_exfiltration_indicators._query(bulk.url) 2389ms 2026-04-20T14:05:01
tc_5ee56f51 find_data_exfiltration_indicators._query(bulk.email) 163ms 2026-04-20T14:05:02
tc_c08d8df1 find_data_exfiltration_indicators._query(bulk.domain) 968ms 2026-04-20T14:05:03
tc_36d9bde7 find_data_exfiltration_indicators._search(all) 17ms 2026-04-20T14:05:03
tc_ad5138ea find_data_exfiltration_indicators._query(pcap.http) 83ms 2026-04-20T14:05:03
tc_74fdf0aa find_data_exfiltration_indicators 4764ms 2026-04-20T14:05:03
tc_fac488cc correlate_across_sources 3035ms 2026-04-20T14:05:23
tc_a189a566 search 37ms 2026-04-20T14:06:47
tc_ff573556 search 488ms 2026-04-20T14:07:03
tc_ec686098 list_directory 3ms 2026-04-20T14:07:03
tc_ba4f6e36 search 18ms 2026-04-20T14:07:03
tc_1cc4dfc8 get_raw_output 8ms 2026-04-20T14:07:21
tc_961897f8 search 18ms 2026-04-20T14:07:21
tc_96ee72cb submit_finding 20ms 2026-04-20T14:07:42
tc_dfc3130c search 96ms 2026-04-20T14:07:54
tc_acb23526 search 389ms 2026-04-20T14:07:55
tc_09c0c3a1 start_extraction_batch 2ms 2026-04-20T14:07:55
tc_bc4e4594 get_raw_output 1550ms 2026-04-20T14:08:07
tc_68dab365 search 472ms 2026-04-20T14:08:33
tc_98ec0703 search 514ms 2026-04-20T14:08:53
tc_d223f646 search 8ms 2026-04-20T14:08:53
tc_5e498239 search 28ms 2026-04-20T14:08:53
tc_c40d3d05 run_bulk_extractor 60553ms 2026-04-20T14:08:55
tc_1140b14d search 52ms 2026-04-20T14:09:09
tc_4f836d43 search 11ms 2026-04-20T14:09:09
tc_d952c40f extract_file_by_inode 154ms 2026-04-20T14:09:10
tc_0b20d9fc extract_file_by_inode 19ms 2026-04-20T14:09:21
tc_e09ed520 extract_file_by_inode 19ms 2026-04-20T14:09:21
tc_6b153965 extract_file_by_inode 20ms 2026-04-20T14:09:21
tc_711590cc search 504ms 2026-04-20T14:09:43
tc_6417e74e search 35ms 2026-04-20T14:09:43
tc_79316b24 check_extraction_status 0ms 2026-04-20T14:09:43
tc_5ee930be run_bulk_extractor 118264ms 2026-04-20T14:09:53
tc_22424360 submit_finding 15ms 2026-04-20T14:10:12
tc_3d05afc3 assess_recovery._query(tsk.filelist) 1008ms 2026-04-20T14:10:56
tc_6899fd67 assess_recovery 1064ms 2026-04-20T14:10:56
tc_93de0e31 search 30ms 2026-04-20T14:10:56
tc_405b2871 search 27ms 2026-04-20T14:11:15
tc_c3027337 search 18ms 2026-04-20T14:11:15
tc_a214ab50 get_completed_results 0ms 2026-04-20T14:11:15
tc_cc5428ed submit_finding 16ms 2026-04-20T14:11:53
tc_626b7c6d search 112ms 2026-04-20T14:11:54
tc_f9b1da94 correlate_across_sources 5456ms 2026-04-20T14:12:18
tc_f49ca274 search 10ms 2026-04-20T14:12:18
tc_8d6e07a0 search 8ms 2026-04-20T14:12:18
tc_1dff911d audit_evidence_coverage 6099ms 2026-04-20T14:13:05
tc_644bed71 audit_tool_coverage 48ms 2026-04-20T14:13:08
tc_2fe9a433 submit_finding 13ms 2026-04-20T14:14:10
tc_f3f18ee8 submit_finding 12ms 2026-04-20T14:14:10
tc_b7773724 submit_finding 11ms 2026-04-20T14:14:10
tc_6efb6596 submit_finding 10ms 2026-04-20T14:14:10
tc_46491f0d submit_narrative 14ms 2026-04-20T14:15:25

Each finding traces back to the specific tool calls that produced the supporting evidence.

▶ LogKext Keylogger Installed on Tracy's MacBook Air 3 refs
1
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-06-28-1600.eml", "max_bytes": 1048576 }
tc_38c3eb1c
3ms
2
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-06-29-1100.eml", "max_bytes": 1048576 }
tc_4d0e371b
3ms
3
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-02-1200.eml", "max_bytes": 1048576 }
tc_63ef6a7d
2ms
▶ Tracy Exfiltrated Confidential NGDC Stamp Exhibit Documents 5 refs
1
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-09-1300.eml", "max_bytes": 1048576 }
tc_0b62886e
10ms
2
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-10-1000.eml", "max_bytes": 1048576 }
tc_c97f423a
9ms
3
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-02-1500.eml", "max_bytes": 1048576 }
tc_9aeda5b6
3ms
4
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-02-1200.eml", "max_bytes": 1048576 }
tc_63ef6a7d
2ms
5
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-06-29-1100.eml", "max_bytes": 1048576 }
tc_4d0e371b
3ms
▶ Stolen NGDC Documents Found on Tracy's External Drive 3 refs
1
run_fls
{ "image_path": "/evidence/ngdc/tracy-external/tracy-external-2012-07-16-final.E01", "partition_offset": null }
tc_13854cb7
26305ms
2
search
{ "max_results": 20, "query": "Stamp", "regex": false, "source": "tsk.filelist" }
tc_bfc3e8d3
20ms
3
search
{ "max_results": 20, "query": "Insurance", "regex": false, "source": "tsk.filelist" }
tc_21776942
13ms
▶ Tracy Emailed Stolen Documents to Coral (coralbluetwo@hotmail.com) with Subject "things" 4 refs
1
run_bulk_extractor
{ "features": null, "image_path": "/evidence/ngdc/tracy-home/tracy-home-2012-07-16-final.E01", "max_depth": null, "sc...
tc_f7ca6c35
474437ms
2
run_fls
{ "image_path": "/evidence/ngdc/tracy-home/tracy-home-2012-07-16-final.E01", "partition_offset": null }
tc_06434451
267240ms
3
search
{ "max_results": 20, "query": "coralbluetwo", "regex": false, "source": null }
tc_721e9acb
12ms
4
search
{ "max_results": 20, "query": "public.zip", "regex": false, "source": null }
tc_5897fdab
440ms
▶ Joe Installed LogKext Keylogger on Tracy's MacBook Air 2 refs
1
search
{ "max_results": 20, "query": "LogKext", "regex": false, "source": "tsk.filelist" }
tc_3ca44269
34ms
2
run_fls
{ "image_path": "/evidence/ngdc/tracy-home/tracy-home-2012-07-16-final.E01", "partition_offset": null }
tc_06434451
267240ms
▶ Coral Forwarded Stolen NGDC Documents to Perry Patsum 3 refs
1
search
{ "max_results": 20, "query": "Some things", "regex": false, "source": null }
tc_961897f8
18ms
2
run_bulk_extractor
{ "features": null, "image_path": "/evidence/ngdc/carry-tablet/carry-tablet-2012-07-16-final.E01", "max_depth": null,...
tc_9e443fdd
480779ms
3
search
{ "max_results": 20, "query": "coralbluetwo", "regex": false, "source": null }
tc_721e9acb
12ms
▶ Joe's Search History Reveals Intentional Keylogger Research and Deployment 2 refs
1
search
{ "max_results": 10, "query": "logkext", "regex": false, "source": "bulk" }
tc_6417e74e
35ms
2
search
{ "max_results": 20, "query": "LogKext", "regex": false, "source": "tsk.filelist" }
tc_3ca44269
34ms
▶ Tracy Facilitated Unauthorized Physical Access for Coral/Carry 1 refs
1
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-10-1000.eml", "max_bytes": 1048576 }
tc_c97f423a
9ms
▶ Wider Conspiracy Network: Pat, King, Coral/Carry Connected via "can't pass up" Email 3 refs
1
search
{ "max_results": 10, "query": "throne1966", "regex": false, "source": "bulk" }
tc_405b2871
27ms
2
search
{ "max_results": 20, "query": "perrypatsum", "regex": false, "source": null }
tc_146dd7d9
16ms
3
run_bulk_extractor
{ "features": null, "image_path": "/evidence/ngdc/carry-tablet/carry-tablet-2012-07-16-final.E01", "max_depth": null,...
tc_9e443fdd
480779ms
▶ Financial Motive: Tracy's Tuition Crisis Drove Insider Theft 4 refs
1
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-06-29-1100.eml", "max_bytes": 1048576 }
tc_4d0e371b
3ms
2
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-02-1200.eml", "max_bytes": 1048576 }
tc_63ef6a7d
2ms
3
read_evidence_file
{ "file_path": "/root/.mulder/cases/extracted/email/email/logfile-2012-07-06-1100.eml", "max_bytes": 1048576 }
tc_d595d352
11ms
4
search
{ "max_results": 10, "query": "logkext", "regex": false, "source": "bulk" }
tc_6417e74e
35ms
▶ VM.vmdk Virtual Machine on Tracy's External Drive 2 refs
1
list_files
{ "include_deleted": true, "path_filter": null }
tc_4dbd286c
999ms
2
run_fls
{ "image_path": "/evidence/ngdc/tracy-external/tracy-external-2012-07-16-final.E01", "partition_offset": null }
tc_13854cb7
26305ms
▶ NGDC Interior Network Traffic Shows Webmail Access During Work Hours 3 refs
1
search
{ "max_results": 10, "query": "mail", "regex": false, "source": "pcap" }
tc_68dab365
472ms
2
run_pcap_analysis
{ "display_filter": null, "max_packets": 10000, "mode": "all", "pcap_path": "/evidence/ngdc/net/ngdc-exterior-2012-07...
tc_94445a32
5136ms
3
run_pcap_analysis
{ "display_filter": null, "max_packets": 10000, "mode": "all", "pcap_path": "/evidence/ngdc/net/ngdc-interior-2012-07...
tc_360b6a0d
8394ms

Tool Call Details

⌘
↑↓ navigate ↵ open esc close
Copied to clipboard