Acuity Health: Part 6 — Digital Forensics & EHR VIP Breach
A step-by-step digital forensics walkthrough investigating an insider exfiltration event targeting VIP patient records in an urgent care EHR database.
Autopsy
Healthcare Incident Response, Computer Network Forensics & Containment
Digital forensics investigation and chain-of-custody framework analyzing an unauthorized EHR database breach involving VIP patient healthcare records.
Forensic Investigation Findings: Incident Reconstruction, Root Cause, and Expert Witness Report
This investigation provides a forensic analysis of a mobile device associated with ‘THISISDIFIR’ to determine the user’s location on April 5, 2020, identify communications with Josh Hickman, and investigate any physical …
Standard Operating Procedures (SOP) for Digital Forensics and Evidence Handling
In the current legal and technological landscape, the integrity of an investigation depends entirely on the reliability of the evidence presented. Digital evidence is uniquely characterized by its fragility and susceptib…
Legal Admissibility of Digital Evidence: Federal Rules of Evidence and Daubert Standards
Digital evidence is defined as any data of investigative value that is stored or transmitted in binary form. Recognizing its importance helps forensic analysts feel assured in the reliability of their work when reconstru…
Mobile Device Forensics: Extraction, Decoding, and SQLite Database Analysis
What is the phone number of this phone? The phone number is the same as the Mobile Subscriber Integrated Services Digital Network (MSISDN) number for the SIM card….
Forensic Artifact Analysis Using Autopsy: File System Reconstruction and Timeline Carving
Academic research analysis exploring examine the evidence using autopsy within the context of Cyber Incident Response and Computer Network Forensics….
Digital Forensics: Evidence Acquisition, Chain of Custody, and Volatile Memory Preservation
Why or why not? No, because the data changed, and since hashing algorithms are designed to produce the same value for identical inputs. Any changes to the inputs result in a different hash….
Enterprise Incident Response Plan and RACI Governance Matrix
In 2008, while working at a university, I inadvertently triggered a bulk deletion script in the production environment instead of a test folder, erasing approximately 50% of the student body’s accounts before I could hal…