Digital-Forensics-Investigation-

National Art Gallery Heist (Autopsy) *** Under Construction ***

Introduction:

On January 21, 2016, Digitech Inc. was called in to assist the National Gallery, Washington D.C. (NGDC) case involving the conspiracy associated with the theft of valuable stamps and defacing of museums are at the NGDC.

Findings

Digitech Inc. found that Tracy who works at the National Gallery had the motive of financial gain and the resources to pull of heist to steal stamps with her brother Pat aka Perry and someone nicknamed King who Pat bribed to join him on the heist. Digitech Inc. also found that evidence in Tracy’s Phone that indicated the knowledge of the heist, the preparation for the heist, blackmail for the heist and Tracy release sensitive security information. Such as, security officer rotation information, planting an unauthorized tablet into the gallery, and gave insurance information which showed the value of the stamps.

Equipment Used During the Investigation

1. Azure Labs
2. Kali Linux
3. Linux Terminal
4. Autopsy
5. sqlitebrowser
6. Microsoft Excel
7. Google Maps Creator

Evidence: Tracy's Iphone

Local Law Enforcement was able to obtain and extract a bit stream image of her Iphone. We were able to find The Follwoing Information (using the foresnics tool autopsy) about The Iphone.

1. Hashes of Phone

• MD5: 34c4888f095dc32413330462923f6fea5
• sha256: 71aed05a86a753dec4ef4033ed7f52d6577ccb534ca0d1e83ffd27683e621607

2. gerneal.log

• Phone Model: Iphone 2
• Phone OS:4.2.1
• Install Time: 6/6/2012 12:03:28

3. lockdown.log

• Host Name: Tracy sumtwelve's Iphone
• Phone Number: 1(703) 340-9661
• ICCID: 89014103255195342366

4. wildcard_record.plist

• IMEI: 012021003735398

5. Envelop Index

• Uses Email: tracysumtwelve@gmail.com

Evidence to Establish Involved Persona's

This section establishes aliases, phone number, emails addresses, assoicated with each person and relationships between each indivdual.

Tracy:

• Phone Number: (703) 340-9961
• Personal Email: tracysumtwelve@gmail.com
• Work Email: tracy.sumtwelve@nationalgallerydc.org
• Relationship: Accused

Pat:

• Phone Number: (571) 340-9961
• Personal Email(s): perrypatsum@yahoo.com patsumtwelve@gmail.com
• Relationship: Tracy's Brother

Terry:

• Phone Number: (703) 829-6071
• Email: N/A
• Relationship: Tracys Daughter

Joe:

• Phone Number: N/A
• Email: joe.sum.twelve@gmail.com
• Relationship: Tracy's Ex Husband & Terrys Father

Carry

• Phone Number: (202) 725-2124
• Email: N/A
• Relationship: Tracy's Friend * Coconspirator

Evidence relating to defacement of museum art

This sub-section provides details regarding the evidence found as it relates to the defacement of museum art.

Even though there is evidence of the possible theft of stamps I did not see any evidence or knowledge of the defacement of property within the National Gallery of Art from Tracy. If there was a motive to deface any of the gallery’s property it did not come from Tracy.

Conclusion

Tracy Was involved with giving insider information, planning, and gathering supplies for the heist. There is evidence of the conversation between her needing money, working with her brother to plan the heist (which includes blackmail of the individual aliased as King), As well as going to multiple locations to get supplies for the heist. Further evidence reveals that she found the stamps on display to worth a substantial value due to the insurance reports which can be seen in Appendix A. And based on Appendix B you can point out the locations that she went to to find the supplies that the individual named King wanted to complete the heist. Tracy doesn’t not seem to have any other motive besides trying to steal the stamps from the National Gallery of Art for financial gain.