Digital Forensics Report 2022

Running head: DIGITAL FORENSICS
Digital Forensics
Name of the Student
Name of the University
Authors’ Note

1
DIGITAL FORENSICS
Executive Summary
This report consists of the investigated details of the Enron scandal so that the reason of the
collapse can be examined. Enron was one of the fastest growing and largest Companies. The
services that were provided by Enron were broadband services, wholesale services, services of
retail energy and services of transportation. Enron got more famous because of its scandal
incident which was the result of bankruptcy. This incident got acknowledged by every investors
and other companies. The corporate world got to know about the activities after that a
revolutionary change was observed in the corporate world. The analysis that has been conducted
is to find the details of the items that were found during the investigation. Relevant programs has
been used to find the details of the items which are the files associated to the transactions, some
deleted files, keywords that were searched over the Internet, etc. The steps that has been carried
out is discussed in detail in this report which will provide the details of the investigation.
Appropriate tools were used during the analysis of the emails that has been shared and for the
analysis of the evidences. The remaining part of the report is structured as: the description of the
report, incident, analysis of the found items, tools that were used and findings. Lastly the report
concludes with the result that were obtained.

2
DIGITAL FORENSICS
Table of Contents
Introduction......................................................................................................................................3
Analysis Conducted.........................................................................................................................4
Findings.........................................................................................................................................13
Conclusion.....................................................................................................................................15
Bibliography..................................................................................................................................17

3
DIGITAL FORENSICS
Introduction
The Enron Scandal led to bankruptcy in October 2001, the founder of the Enron Company
was Kenneth Lay. It was the fastest growing Company and the accounting firms that were
associated are, Delloitte, Ernst & Young, PwC and KPMG and Arthur Anderson. They were
responsible for the auditing of the financial data. All the shareholders who lost their money were
the victims of the crime committed by Enron and Arthur Anderson. The information they were
using to purchase the Stock was promised to be accurate but in reality it was far from it. At the
time Enron’s bankruptcy was the largest bankruptcy that ever occurred to American history
which makes this one of the biggest scandals in American history.
The forensic tools that has been used to examine the e-mail of the employees are, Aid4mail,
Autopsy and Magnet AXIOM. Aid4mail is considered to be the essential tool for digital
forensics which supports over 40 formats of email. It has helped me in saving time, it is easy to
use and provides accurate solutions. With the help of Autopsy software, major files can be
analyzed such as HFS+, Ext3, Ext4, etc. through the process of hashing. It helps in unloading the
standard zipped files as well as extracting the exchangeable image file format. The back end of
Autopsy includes Perl language which is runnable in LINUX, UNIX, Windows and Mac-OS.
Magnet AXIOM helps me in determining the evidences as it has the capability of decrypting the
full disk and helps in accessing the file system data. For examining the evidences, artifact
explorer, registry and file system explorers, source linking methods are involved.
The files what I have got as evidences are of larger size and I have used metadata to get the
information about these files. Some files are in encrypted form therefore I have used Autopsy for
hashing decryption. I have also used the String searching procedures to find the relevant details

4
DIGITAL FORENSICS
of the files. The files consists of some numeric data as well as many information for which I
have to apply the String search method. The findings that have been discovered includes some
evidences which are internet related and ownership indicator details. I have followed all
procedures to make sure that all the findings are investigated properly. Through String search I
have got to know about the information of various words related to the case. The indicators were
analyzed properly to determine the ownership. Few emails are there which consist of bankruptcy
discussion and about bad credit. Some passwords have also been exchanged by them through
emails and it has been found that data or information were in encrypted for which cryptographic
calculations have been applied to retrieve the original information. For the analysis purpose
different software and associated steps has been followed to examine the emails. All the
processes or mechanism that have been maintained to design this report has assisted in gaining
the ethical perspective of investigation. Moreover, the data that have been collected from the
emails consist of original form.
Analysis Conducted
Relevant programs
To examine the emails of the employees of Enron firstly Aid4Mail is used for which I
have to create folders and respective subfolders to install the Aid4Mail in the system. The
Enron EDRM data set is of size 18GB which I have downloaded and uncompressed the
files. The file of ‘.pst’ format have been downloaded then sequential steps were followed
which includes Source MAPI folders window, selection of the range of data, etc. Then in
the Target Setting consists of all the work folders and sub folders in which I have
included the CSV files, these files are the converted form of the emails. I have examined
the emails for getting the cause of the bankruptcy and found that there are system outrage

5
DIGITAL FORENSICS
notifications received in the email along with the suspension of Fed Ex but no proper
measures are taken and no reply is given to the mails. From the email it can be found that
the person has contact with another person since he received a mail as “Please delete all
messages that you received from me today”, that proves that he has contact with external
person who was a threat for the company. We have also found an alert may that says to
not open messages with Hi as the subject and having URL or .xls as the attachment.
There are other messages that proves that Eric sells products on ebay and has contact
with other people for sharing username and password and at every weekend
automatically taking data from the database by uploading a malware in the system.

6
DIGITAL FORENSICS

7
DIGITAL FORENSICS

8
DIGITAL FORENSICS
To use the Autopsy software for Windows, the Enron case has been entered in the
Create New Case button after which in the additional information window the date and
Case number has been entered and proceeded. Then after few more steps, the processing
of the modules was integrated by Autopsy. After following these steps, I have researched
for the role of Kenneth Lay in the scandal.

9
DIGITAL FORENSICS

10
DIGITAL FORENSICS

11
DIGITAL FORENSICS
The above screenshot proves that Ken Lay has earned 100 million by selling the
stocks and is known by his co-worker Chris Moore. The message was deleted by Ken
Lay after he received it and it proves him guilty for the downfall of Enron.
By using the Magnet AXIOM I have extracted the histogram view of the shared
emails due to which I was able to identify the frequencies of data occurred in the dataset.
Visualization of the huge datasets and became easier therefore, it got easier to interpret
the data.

12
DIGITAL FORENSICS

13
DIGITAL FORENSICS
Techniques Used
During the analysis of the data, it has been found that few techniques were used to
hide the data which includes encryption, steganography, hidden attributes, hidden
partitions, etc. Generally, the encryption of the data can be done with key format which
are symmetric-key encryption, public-key encryption. To decrypt the encrypted files,
finding the keys is necessary to get the access of the information. In case of symmetric
key algorithm, trial and error method is used to find the correct key. For Public key
algorithms, the part of key is known as one part have public access and the other half can
be derived through mathematical calculations. The decryption process is dependent on
the key length of the encrypted data and the measurement is done in bits. For public-key
encryption RSA cipher is used for encryption therefore, for decrypting mathematical
calculation was done to retrieve the original information.
 Graphic Image Analysis
From the image graph it has been analyzed that the in the month of July of 2017 the email
traffic reached to the peak. And from the other case analyzed it can be concluded that the
enron stocks were cleared during this time. This was the time just before the company
was declared bankrupt and there has been an increase in regulation and oversights such
that the scandal can be prevented. The shares of the company was released and the unit
loss also caused the company to become bankrupt.
Findings
With the initial findings it has been found that Enron has violated the rules relevant to
dealings with banks. The auditing partners of Enron and Kenneth got involved in the fraud
activities. The budget relevant files consist of the loan details. On the basis of the findings the

14
DIGITAL FORENSICS
first lesson derived is that the directors of Enron could not avoid the major issue of dispute of
interest. Because of following major accounting practices without proper planning for the
mitigation for the probable risks. Although, these manipulations, applications of practices
resulted in gaining the huge amount of compensation as well as returns. Some files consists of
the information that are in encrypted form and it has been mentioned earlier in the report.
Few evidences has proved that there was corporate mismanagement, high standards of
accounting and failure of regulatory. The other files that were found during analysis consist of
the deleted files that has been retrieved with the help of the data recovery wizard. Some
keywords has also been found in the search engine history. The searching functionality consist of
reviewing of the searched results, sophisticated search engine has been used to search for the
keywords. The process of searching includes, using of query operators so that it does not get
interrupted by the case insensitive issues. Some string such as ‘Savings Plan’ and ‘ESOP’, Enron
Employee Stock Ownership Plan which relates to the plans of the investment. Other strings such
as ‘Cornhusker’ and ‘Project Steele’ which is relevant to purpose of the entities that the helped
the Company in hiding the debt details therefore, resulted ins failure of the deals. The logics that
has been designed to examine the keywords requires the scanning of every single keyword
hence, each string were copied on the search field to get the results.
The evidences based on internet which were found during the analysis of Web site traffic
analysis consist of the chats, emails, cache file and news group activity. It has been mentioned
earlier about the details of the analysis of email and in the chats there various strings for which
the search query logic have been applied. The activities of the news groups includes the details
of the loss of money, information related data hiding, etc. The registration information helped in
finding the owner of the relevant programs that was carried out in the Company.

15
DIGITAL FORENSICS
Conclusion
Thus from the report it can be concluded that numerous factors were involved to cause
the collapse of Enron. Form this report it can be derived that poor management of the processes
and high standard accounting practices were followed without the mitigation planning. Due to
these risky practices the Company became unable to prevent the future risks. The email that were
shared has been analyzed with the tools like Aid4Mail, Magnet Axiom and autopsy which made
the easier analysis and better data retrieval such as histogram view of the email. The histogram
view of the emails helped to analyze the frequency of the information that has been shared. To
examine the strings or keywords, different search queries were designed to find the relevant
information that were associated to the strings. The executives of Enron was mainly responsible
for the bankruptcy many wrongdoings has been followed in the Company. Proper functioning of
the practices of internal auditing was not maintained and even the external auditor got involved
in the improper reporting of Finance and fraudulent accounting due to which the corporate
management got difficult.
Therefore, it suggested that to maintain a healthy corporate management, the dual
activities of the seniors executives should be allowed in an Organization. The responsibility to
handle the shareholder’s interest should be separated so the decision making process and
providing advices to the shareholders should be controlled by chairperson of the Company
instead of the senior executives. Managerial performance is an important factor of organizing the
activities therefore, if any wrongdoing is found by the CEO then an authorized person should be
there to make the CEO resign from the job. For this case, Kenneth lay contributed in various
fields of the Company to manage most of the operations which resulted in improper
management. During the analysis it has been found that the emails consist of shared files,

16
DIGITAL FORENSICS
password, and information sharing regarding the plans and policies. The information were in
encrypted form due to which the efficient programs were used to acquire the findings.

17
DIGITAL FORENSICS
Bibliography
Årnes, A. (Ed.). (2017). Digital forensics. John Wiley & Sons.
Baig, Z. A., Szewczyk, P., Valli, C., Rabadia, P., Hannay, P., Chernyshev, M., ... & Syed, N.
(2017). Future challenges for smart cities: Cyber-security and digital forensics. Digital
Investigation, 22, 3-13.
Chen, L., Takabi, H., & Le-Khac, N. A. (Eds.). (2019). Security, Privacy, and Digital Forensics
in the Cloud. John Wiley & Sons.
Dang-Nguyen, D. T., Pasquini, C., Conotter, V., & Boato, G. (2015, March). Raise: A raw
images dataset for digital image forensics. In Proceedings of the 6th ACM Multimedia Systems
Conference (pp. 219-224). ACM.
Enron Scandal: The Fall of a Wall Street Darling . (2019). Investopedia. Retrieved 12 October
2019, from https://www.investopedia.com/updates/enron-scandal-summary/
Farid, H. (2018). Digital forensics in a post-truth age. Forensic science international, 289, 268-
269.
Grajeda, C., Breitinger, F., & Baggili, I. (2017). Availability of datasets for digital forensics–and
what is missing. Digital Investigation, 22, S94-S105.
Holt, T. J., Bossler, A. M., & Seigfried-Spellar, K. C. (2017). Cybercrime and digital forensics:
An introduction. Routledge.
Karie, N. M., & Venter, H. S. (2015). Taxonomy of challenges for digital forensics. Journal of
forensic sciences, 60(4), 885-893.

18
DIGITAL FORENSICS
Nance, K., & Bishop, M. (2017). Deception, Digital Forensics, and Malware Minitrack
(Introduction).
Ozel, M., Bulbul, H. I., Yavuzcan, H. G., & Bay, O. F. (2018). An analytical analysis of Turkish
digital forensics. Digital Investigation, 25, 55-69.
Ramadhani, S., Saragih, Y. M., Rahim, R., & Siahaan, A. P. U. (2017). Post-Genesis Digital
Forensics Investigation. Int. J. Sci. Res. Sci. Technol, 3(6), 164-166.
Sammons, J. (Ed.). (2015). Digital forensics: threatscape and best practices. Syngress.
Van Beek, H. M. A., van Eijk, E. J., van Baar, R. B., Ugen, M., Bodde, J. N. C., & Siemelink, A.
J. (2015). Digital forensics as a service: Game on. Digital Investigation, 15, 20-38.
Vincze, E. A. (2016). Challenges in digital forensics. Police Practice and Research, 17(2), 183-
194.
Watson, S., & Dehghantanha, A. (2016). Digital forensics: the missing piece of the internet of
things promise. Computer Fraud & Security, 2016(6), 5-8.