You will need a dongle to load this into FTK.
Steve Hunter is an employee in Accounting at American Pacific University (APU). Gloria Andrews is also an employee. Ms. Andrews complained to the management that Mr. Hunter had approached her after work at a bar and she had rebuffed him. He then sent her several emails under the name theMan asking her out. The emails became abusive and later contained pornographic files. A later email series arrived for her from someone called Chest Brockwell which were threatening and filled with pornographic suggestions and photos.
Since Management didn't take any action, Ms. Andrews resigned her position and hired an attorney. She also contacted the local police who could take no action without evidence of a crime. The IT department only had copies of the emails since they recycled her machine and didn't have records indicating to whom it had been issued. The machine could have been issued to any one of almost 35 people who were hired that month. The emails are attached as files below. IT did not capture the headers.
When questioned by security on this matter, Mr. Hunter denied all accusations and said that instead, Ms. Andrews approached him in the bar, very intoxicated, with an obscene suggestion and he declined due to his being married. She then sent him some nasty comments via email from an account gloria761@yahoo.com to which he did not reply. Mr. Hunter suggested that perhaps Ms. Andrews approached many men and women with sexual suggestions and perhaps one of them took it to heart. He even proposed that Ms. Andrews might be posing as him since anyone can create yahoo and msn accounts easily. The investigator then asked why he named those two sources and he said, that was what everyone uses. Oddly enough, those were the two sources of email from Mr. Hunter.
Mr. Hunter was asked to voluntarily submit to having his machine imaged and said "No, not without a warrant. I don't want any planted evidence turning up on my machine that she put there." When IT investigated with legal, it became evident they needed no warrant and returned and seized the machine which was turned off at the time. The drive was imaged. Mr. Hunter said he had no email accounts on yahoo or msn under any name.
The emails are saved from thunderbird. There are no hashes or other information available from IT.
Your job is to evaluate the situation and see if you can prove that Mr. Hunter or Ms. Andrews is telling the truth. So far, Ms. Andrews has not filed a lawsuit and Mr. Hunter is still employed but the company wants to resolve this quickly. Any evidence related to the names: Steve Hunter, theMan10900, Chest Brockwell, theChest, or other relevant material, including pornography or illegal materials is useful. Of particular use would be evidence of the graphic pornography found in the 6 JPGs on Mr. Hunters drive.
Assumptions:
Dogs are adult models in pornographic photos.
Cats are underage models in illegal pornographic photos.
Any pictures of or references to gardening may be considered pornographic/sexual suggestions and photos.
Paintings of bucolic scenes (especially by Millet) are considered graphic sexual pornography.
Painting by Salvidore Dali are just cool but if they are surrelistic visions of bucolic scenes then they may be considered surrelistic pornography.
The image is fairly large (is a 4 gb drive compressed to 800 mb).
Hunter image is on DVD.