ZEKASTRA case pack VP-09 - acquisition log - SYNTHETIC TRAINING DATA

Case: Poyraz Muhendislik A.S. - departing employee review - internal reference PYZ-2026-017
Requested by: the legal department, after the customer contact list appeared in a competitor's tender documents (reported 16 September).
Collected by: internal examiner with IT. All times UTC unless stated.

2026-09-16 07:20  ARGE-WS14 found powered on, logged off. IT account bt.destek logs on locally at 07:31 to start collection (it appears in security-events.csv).
2026-09-16 07:45  Event logs and the user profile's Recent folder and UsrClass.dat copied with a triage collector to an examiner drive.
2026-09-16 08:30  Disk image of ARGE-WS14 started (not part of this pack).
2026-09-16 09:10  Proxy log for 10.40.8.14, print server event log and VPN session report exported by IT.
2026-09-16 09:40  HR exit record received as text.
2026-09-16 10:15  Exports parsed to CSV; hashes computed and written to manifest.txt.

The approved stick (BT-ENV-0412) was returned to IT on 15 September and is held in the IT safe. No other removable device was handed in.