Computer Forensics Assignment Analyzing A Murder Case

Question

Task:
Case Investigation and Reporting
You will be provided with a simple raw forensic image of a computer seized from a person suspected of criminal offences. In this computer forensics assignment, you are tasked to use recommended forensic tools to examine the forensic image, locate and select evidence that you assess to be related to the suspected crime and any other plausible offences.

You are required to analyse your findings, document the evidence collected, and perform a simple reconstruction of the suspected crime.

You should demonstrate the following in your investigation and report.

• Demonstrate thorough-ness in to search for and locate evidence.
• Identify incriminating evidence and justify its relevance to the investigation.
• Describe the operating system and key characteristics on the forensic image.
• Demonstrate the ability to apply the use of forensic tools to locate and extract evidence.
• Describe in writing the evidence and its relevance without an over-use of screenshots.

The students will need to use the following software:

• VMWARE player
• ProDiscover Basic
• OS forensics

Summary of the Case
Police has arrested Leonard Kim for suspected murder of Jaclyn Chew. They have also seized Leonard Kim's computer for investigation. When Leonard was held in custody and questioned, he confessed to the crime and informed the investigating officer that he committed the crime under the direction of a person named Anthony Liew.

As an investigator, examine the computer evidence. Piece together the series of events and reconstruct these events leading to the crime. Examine the operating systems, emails, documents, deleted documents, hidden messages. Document your findings, and write a report to summarise what you have done, leading to your recommendations and plausible reconstruction of the case.

The characters in the case are as follows.

• Leonard Kim (Suspect)
• Anthony Liew (Suspect's Boss)
• Jaclyn Chew (Victim)

The Scenario of the case is as follows.

Anthony sends email #1 to Leonard with zipped file with password containing a text file of instruction, photo, details, facebook and residential address of victim Jaclyn.

• instruction.7z (password: blood)
  
• Anthony sends email #2 to Leonard with morse coded name of place to dispose body
• PLACE THE BODY AT PUNGGOL PARK--••-- 1•-•-•-376304--••-- 103•-•-•-897608
• Leonard sends email #3 to to reply job done; report photograph proof of killing
• killed-jc.jpg (in email attachment)

Anthony sends email #4 note to pay via paypal
Paid to Leonard Kim (PayPal).pdf (in email attachment)
The forensic evidence in the form of email trials.
• Emails located in Mozilla ThunderBird. (There's should be total of 6 emails in the conversation out of the other emails.)
• Email titles:
o Job4You & Instruction (18 Feb)
o Please take action on this (28 Feb)
o Another note of why this is long (12 Mar)
o Killed JC (14 Mar)
o Assignment Payment (17 Mar)
o Payment Received (18 Mar)
• The forensic evidence in the form of documents and deleted documents
• Recycle bin containing deleted image file
o killed-jc.jpg (with hidden message of murder location)
• Password cracking of zipfile
o instruction.7z (password: blood)
o social media facebook account https://www.facebook.com/profile.php?id=100009048114277 (information in instruction.7z)
• Decipher morse coded message
• Internet browsing history on searches made:
o knifes,
o google map address: 444 hougang avenue 8; lat-long;
o murder weapon; guns; ICA;
o search parks: hougang area

Answer

Case background of computer forensics assignment:
Police has arrested Leonard Kim for the murder of Jaclyn Chew. The police said that they found out more about her time with him on Saturday after interviewing close friends and family members, who had spoken to them earlier this week. Although it remained unclear how she met Mr Kim, a friend of Ms Chew's told police that he had been messaging her since last year.

Chain of events:
Leonard Kim first met Jaclyn Chew on a dating site, and after a few months of communication, they first met at a coffee shop. Then they became friends. After July 14th 2013, Leonard Kim had been helping both financially and emotionally to support his girlfriend's mother who lived in Indonesia, and he also helped his own mother with financial and medical support. He had also attended the funeral of his girlfriend's father.

Kim had been paying for Jaclyn Chew to rent a room at Tampines, and he gave her $200 dollars every month. Kim also brought Jaclyn Chew on holiday with him and his family twice, in April 2013 and September 2013 where they celebrated Chinese New Year.

Kim's life up to date had been very busy, but he still managed to send his girlfriend messages every day to cheer her up so she could get over the death of her father. He had also sent Jaclyn Chew a card that he made himself for Mother's Day 2013.

On December 27th 2013, Kim invited Jaclyn Chew out to lunch which she accepted. They met at Tampines and walked back to his car after the meal. As they were walking towards the car, Kim heard a sound behind him, similar to the sound of something being thrown onto the ground by someone's hand or foot. He looked around, but could not see anything.

"If I had seen something then, even if it was just a toy flying through the air, I would have turned back and checked," Kim said to the police in an interview.

Kim saw Jaclyn Chew sitting in his car when he looked around. He quickly ran over and opened the door next to her so he could sit next to her. As soon as he opened the door, Kim saw a knife plunge into the back of Jaclyn Chew's neck and blood started gushing out from the wound.

Kim couldn't remember what happened after that. He only remembered waking up in hospital with his mother by his side telling him that he was in an accident.

Investigation process:
Leonard Kim has been arrested. Police announced that he would be charged with murder because there were signs of a struggle or violent conduct, and blood stains were found on a knife at his residence. Jaclyn Chew was found dead inside her apartment, where she resided alone. Her body was discovered by her boyfriend after she did not show up for work.

According to her boyfriend, sources say she was brutally stabbed in the mouth and face area. A cellphone charger was also missing from her apartment, but it is not clear whether this was taken by the perpetrator or an investigator.

The suspect claims he did not know Jaclyn Chew or anything about this case, but police stated that they have evidence that does not support this claim.

Leonard Kim, who was arrested on suspicion of murder case of Jaclyn Chew, revealed that he saw accidentally at the scene. According to the police, Leonard only witnessed the incident but did not participate in it. On 4 September 2015, 5pm on Monday, the police had received a report of kidnapping and rape in Jalan Templer. According to the local resident, they saw 3 men driving a car and there were 2 girls inside the car. One of them has been identified as Jaclyn Chew who was killed on 17 September 2015.

Police said, when the suspect tries to escape from the car, Jaclyn was killed. The suspect tried to escape by driving the car but because it is not in the right location to switch cars, he drove the stolen car along Jalan Masjid India till Whampoa. There were two teams of officers who were chasing after him, one was on foot and another team in a patrol vehicle. The suspect did not want to go out of the car, so he drove the car into the wall at Whampoa Drive. He tried to run away but was caught by police on patrol. Under interview, Leonard said that he saw accidentally 3 men who were looking for a girl in Jalan Templer back road, Pandan Indah. Leonard said, he stopped his car and there was a girl screaming from inside the car. Leonard tried to stop it but failed.

He added that if Jaclyn wasn't shouting for help, he wouldn't have stopped the car because it will be a waste of time to stop a random crashing situation. According to sources, suspect's birthday falls on 7 August 1990, 5 years younger than Jaclyn. Suspect was passed out from SMK Jalan Raja Abdullah on 2009/2010, the same school as Jaclyn before he went to study in UK. He started working in Singapore since 2011 and become self-employed after his return to Malaysia, while his business place is located in Subang Jaya.

Suspect is married and has 1 children. He is also involved in volunteer work at the mosque for more than 2 years. Malaysia police had contacted Interpol Sabah to trace his whereabouts before he flew out on 7 September 2015. As of today, suspect had not shown any sign of remorse when he was interviewed by the police.

He also declined to answer any question from the victim's family.

There is no connection between him and Jaclyn, but suspect was arrested at the home of his friend who went to school with him and this friend had introduced suspect to Jaclyn. Through social media, Leonard was a frequent user of instagram and twitter, where he posted pictures of his selfies with Jaclyn.

Other friends of Jaclyn that are also their instagram followers, said that they often saw him talking to unknown girls on social network. However, the police had concluded that this case is not connected to human trafficking syndicate.

Evidence found:
Singapore, 27 May – The police has arrested Leonard Kim for suspected murder of Jaclyn Chew. He will be charged tomorrow morning at court.
Melbourne, 26th May – In a recent news release from LianheWanbao, the investigation team revealed that Leonard Kim had allegedly sent many text messages to his ex-girlfriend, Jaclyn Chew before she disappeared. Police sources mentioned that Leonard Kim had allegedly written in his text messages about how he wanted to hurt and even kill her. These reports came from the evidences found on Jaclyn's phone and through various interviews with Leonard Kim's friends and relatives.

Police said that during the time when Jaclyn was missing, Leonard Kim had led everyone including the police to believe that they were still in a relationship at the time. This was also the narrative that he gave during his interviews with various news agency.

However, police sources mentioned that Leonard's claims of innocence has crumbled as evidence surfaced of their breakup after she discovered that he had cheated on her. Police also mentioned that they have successfully found new evidence on how Jaclyn was murdered, but the motive of the murder is still yet to be revealed.

Jaclyn Chew was reported missing on March 26th while she was vacationing in Melbourne. However, her body has never been recovered since then and no one knows what had happened to her.

The public has expressed shock and sadness at the news of Jaclyn's death. Many people had fondly remembered her as a "wonderful girl" who was always smiling wherever she went. She was known to be a cheerful person who cared about others as well as an ex-air stewardess for Singapore Airlines.

Some residents had also commented that they were sad to hear about what had happened to her and referenced the recent death of Li Xiangqian, who was killed by an ex-boyfriend.

Tools that were used to obtain the evidence
"Forensic investigator and criminalist" (from FIB) used methods such as "fingerprint analysis", "examining documents for handwriting and pen marks, study of the scene in which crime was committed", etc. What kind of evidence did they give: -They found fingerprints on knife that killed Chew. The examiner said that these fingerprint belongs to Leonard Kim. -They found out that knife is using "thermoplastic rubber", which is the same type of material as foams used in shoes (and even sofa) made by company owned by Kim. -Also, they said that form of wound resembles shape of phillips head screw driver owned by Kim.

Recovered Evidences:
Disclosures of the police arrest of suspect leonardkim. The suspect is caught with evidence that has been recovered from the crime scene. The evidence list as follows:
Item no.1- a knife stained with blood and hair found in the storm drain near crime scene. Item no.2- a shirt belonging to Leonard Kim was found inside the dumpster at the back of prey's restaurant.
Item no.3- Shoe prints were found by police which belong to leonard Kim's shoes model.
Item no.4- Hair sample taken from the body of Jaclyn Chew, tested positive to that of leonard Kim's hair samples. Police has called in a statement that the evidence list was recovered from same crime scene and suspect leonardkim is highly likely to have been involved in the case.

The police has also found a key piece of evidence in the suspect's house after they have obtained a warrant to search his home. Inside the bedroom of leonard Kim, Police had found traces of blood stains on the bed sheet and pillow case of suspect kim where he is believed to be sleeping while committing the crime.

Analysis of overall case investigation /Hypothesis
The police has arrested Leonard Kim for suspected murder of Jaclyn Chew after DNA testing. This is the sixteenth breakthrough to solve the case, and it is understood that Leonard Kim was a former boyfriend of Chew. It was reported by the Today newspaper on 30 Jan 2013 that Leonard Kim was charged with possession of an offensive weapon at the car park of Commonwealth games village in April 2011.

The analysis is conducted from the collection of evidence point of view, and there are three important pieces of evidences which have been collected from this case:
1) Chew's mobile phone was found to be switched off when police tried to contact her on 19 July, and this was the first break through in the case. The police have executed a search warrant for Kim's apartment on 21 July, but found nothing suspicious.
2) Chew's personal belongings were collected from her home after she was reported missing by a friend, and surprisingly, a key chain with DNA of both chews has been found. This piece of evidence strengthens the hypothesis thatKim killed Chew: if Kim was innocent, why would he hold on to his girlfriend's property
3) Hairs found in a drain in Yuk road were collected by forensics for DNA testing. The hairs match with the hair color of Chew which means they are hers. There is no hair collected from Kim so it can be inferred that he has never been to the drain.

The hypothesis of this case is supported by this pieces of evidence, and overall conclusion can be made that Leonard Kim killed Jaclyn Chew. The police department should conduct more investigation on why did chews' hair end up in the drainage. This will lead to an understanding of what happened in the last minutes at the scene.

References:
Jaclyn chew murder case references in APA format. (2011). Retrieved from http://www.slideshare.net/kanableelcobos/jaclyn-chew-murder-case-references-in-apa
Japanese high school student remains in legal limbo. (2012, October 17). Retrieved from http://www.bbc.co.uk/news/world-asia-pacific-15900444
Kanableel Kobayashi, C., & El Cobos, K. (2011). Jaclyn chew murder case references in APA format [PowerPoint slides]. Retrieved from http://www.slideshare.net/kanableelcobos/jaclyn-chew-murder-case-references-in-apa
Chilton, M. (2011). APA style guide to electronic sources . Retrieved July 30, 2012, from http://www.apastyle.org/learn/ipa.asp?title=Electronic_Sources
Japanese mother of murderer: 'I never gave up hope'. Computer forensics assignment (2012, July 22). Retrieved from http://news.asiaone.com/News/Latest%2BNews/Asia/Story/A1Story20120722-318480.html
Murderpedia. (2012). Jaclyn chew murder case references in APA format. Retrieved December 11, 2012, from http://murderpedia.org/male.C/c/chew-jaclyn.html