ZEKASTRA case pack VP-09 - A departing employee: USB, personal cloud, printer and VPN - SYNTHETIC TRAINING DATA
The company, people, devices, files and times are invented. IP addresses are from documentation ranges (RFC 5737) or private space (RFC 1918) and domains end in .example (RFC 2606).

Scenario (EN)
An engineer at Poyraz Muhendislik A.S. resigned on 1 September 2026 and left on 15 September. A day later the company's customer contact list appeared in a competitor's tender documents. The legal department asks: did company data leave through this employee's workstation or remote access, by which channels, when relative to the resignation, and what can and cannot be shown from these records?

Senaryo (TR)
Poyraz Mühendislik A.Ş.'de bir mühendis 1 Eylül 2026'da istifa etti ve 15 Eylül'de ayrıldı. Bir gün sonra şirketin müşteri iletişim listesi bir rakibin ihale belgelerinde göründü. Hukuk birimi soruyor: şirket verisi bu çalışanın bilgisayarı ya da uzaktan erişimi üzerinden çıktı mı; hangi kanallarla, istifaya göre ne zaman; bu kayıtlarla neler gösterilebilir, neler gösterilemez?

Files
security-events.csv          Workstation logons, logoffs, locks. UTC.
partition-diagnostic.csv     USB storage arrival and removal (event 1006). UTC.
lnk-files.csv                Shortcuts in the user's Recent folder. UTC.
shellbags.csv                Folders browsed in Explorer (UsrClass.dat). UTC.
proxy-log.csv                Web proxy, this workstation only. UTC.
print-log.csv                Print server, event 307, all users. UTC.
vpn-sessions.csv             VPN sessions, all users. LOCAL time UTC+3, DD.MM.YYYY.
ik-kaydi.txt                 HR exit record, approved device and policy. LOCAL time.
export-metadata.txt          Window, time basis and scope of every export. Read it first.
acquisition-log.txt          What was collected, when and how.
manifest.txt                 SHA-256 of every file above.

Rules
1. Verify every file against manifest.txt before you read anything else.
2. Write the time basis next to every time you copy out. Convert to UTC before you compare two sources.
3. Tie a device to files by its volume serial number, not by its drive letter.
4. Report what the records show. A copy, an upload or a print is not proof of who received the data or what they did with it.