You will need the full version of FTK for this case.
Assumptions that are important to the case:
David Fisher is a accounting clerk I at First Municiple Trust bank of Edison, NJ. After a complaint was made about Mr. Fisher's desktop computer wallpaper which displayed a pornographic image, Mr. Fisher's supervisor met with Mr. Fisher on August 5, 2005 to ask him to remove the image. Mr. Fisher said he would comply and was sorry about the whole thing.
Two weeks later, the employee who complained about the image, began receiving emails from an unknown party with the email address of bigd2466@yahoo.com. The emails contained pornographic images which were extremely offensive and threats such as, "You will pay" and "Someday soon, I will give you what you deserve!".
Despite a lack of evidence to the contrary, the company approached Fisher about the matter. Fisher denied any such activity on his part. The employee, Ms. Gloria Costa, claimed she was being harassed at work by Mr. Fisher who had followed her into the WC and demanded she apologize. The supervisor again talked with Fisher about his actions and Fisher said he was "hotheaded" and would apologize to Ms. Costa which he did. Two days later, Ms. Costa received a photograph of a naked man from the neck down which vaguely resembled Mr. Fisher. After being told that she should simply block the email address that sending the files, she asked IT for help.
The IT coordinator said "We block all attachments from yahoo so the file couldn't have been sent that way." Upon inspection of the machine it was found that the file had been placed on Ms. Costa's machine in a directory which was shared on the network and an email had been sent from outside with a link to the directory on her machine! IT said there was no evidence in the logs that showed who had connected to the shared directory on Ms. Costa's machine. The image was saved to a drive and is available to you here. Naked Man Image.
On August 7, 2005, Mr. Fisher began shouting at Ms. Costa and followed her into the WC demanding an apology. Ms. Costa called the police on her cell phone after locking herself in a stall. The police contacted the bank security officers who removed Mr. Fisher and Ms. Costa went home.
Mr. Fisher was asked to apologize for the action and claimed he was a "hothead" and "had this thing about Feminazis who didn't appreciate him". He agreed to apologize and did. Ms. Costa then asked the manager of the office to fire Mr. Fisher. The manager said he felt that was overeacting and refused. Ms. Costa then contacted her attorney and a draft copy of a hostile workplace suit was forwarded to the manager. The suit named the manager in the case and he panicked and fired Fisher. Fisher was escorted from the premises and was told his personal belongings would be sent to him later. When Ms. Costa left work that day she arrived home to find that windows in her house had been broken and someone had painted the word "Bitch" on her front door. She reported Fisher to the police who said they would look into it. There was no evidence Fisher did anything and he denied the charge claiming he was home all the while. Ms. Costa then received an email at her work account that said: "Ha Ha, bitch".
Mr. Fisher then contacted FMT and advised them his attorney was filing a multi-million dollar wrongful termination suit for destroying his good name, defamation of character, etc. Ms. Costa advised that her suit was on hold since Fisher had been fired but if he was allowed to return to work, she would file the suit and she also indicated she had already contacted the television show "Hard Line" which characterizes situations where people are abused by their companies who refuse to solve the problems. The bank was in a panic. Their ad logo is "A good old-fashioned place where family banking meets family values". The president wants the whole matter to go away.
In addition, a collection of photos was sent from the email address cillmall@whome.com. The collection of photos contained pictures described as "victims to be" and said all those people were on the "pink mist list". Bank security is particularly interested in seeing if those photos may also be found on this image. This would make the matter law enforcement related.
You were retained to examine the computer Mr. Fisher used at work. Mr. Fisher was asked if he would surrender his home computer for examination to "exhonerate him" in the case but his attorney refused. The corporate attorneys refused to even try to pursue a subpoena against Fisher since it would expose the bank to a "whole array of liability". Thus, you were retained to examine the image made of the hard drive. The bank wants you to determine if there is any evidence that would support Costa's claims of harassment by Fisher or any other material that would "encourage" him to drop his suit. The bank president cautions you that "under no circumstances are you to release any information to any outside party".
Of particular interest would be tying the NMI to Fisher. But, any other material that would be damaging to him, might be of value in the case.
Examine Fisher and report on any images or other materials you can find.
//Email dates may be in error.
// Fisher Files are in two e image files (fisher.E01 and fisher.E02).
Put both images in a single directory and add E01 as evidence. This should add both images.
