A departing employee: USB, personal cloud, printer and VPN

01Brief

Poyraz Muhendislik A.S. is an engineering firm. A senior design engineer (account e.demir, workstation ARGE-WS14) resigned on 1 September 2026 and left on 15 September; the account was disabled at 18:30 local time that day. On 16 September the company's customer contact list appeared in a competitor's tender documents. IT collected the workstation's event logs, shortcuts and ShellBags, the proxy log for the workstation, the print server's log and the VPN session report. The HR exit record lists one approved, encrypted stick. The VPN report and the HR record are in local time (UTC+3); everything else is UTC.

Internal audit asks:

1. Did company files leave through the workstation or the remote access, and by which channels?
2. When did each channel start, relative to the resignation and to the account being disabled?
3. What do these records prove, and what do they leave open?

Answer from the files only. Name devices, files, addresses and accounts; do not say who received the data, and do not name the competitor as its recipient. The contents of the stick, the cloud account and the printed pages, the file server's own logs and the user's home computer were not examined.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Write the time basis next to every time you copy out. The VPN report and the HR record are local time; convert them before comparing.
• Tie a device to files by its volume serial number. Both sticks were E:.
• Say what each record shows and stop there: a copy, an upload or a print job does not show who received the data.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 30 points.

1. Q011 pointlnk-files.csvmanifest.txt

   On a copy of lnk-files.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.8 hex characters
   Check

2. Q022 pointspartition-diagnostic.csvik-kaydi.txt

   Two USB storage devices appear on the workstation. Enter the serial number of the one that is not the approved stick listed in the HR record.Serial number as written
   Check

3. Q032 pointspartition-diagnostic.csv

   When did the unapproved stick first arrive on the workstation? UTC, to the second.YYYY-MM-DD HH:MM:SS, UTC
   Check

4. Q042 pointslnk-files.csvik-kaydi.txt

   Where does the first copy to the unapproved stick fall against the resignation notice?

   AAfter the notice: the copies belong to the handover period.BBefore the notice: on 28 August at 16:44 UTC, about three and a half days before the notice at 06:12 UTC (09:12 local) on 1 September.CThe same day: the HR record and the LNK files use the same clock, so the dates are compared as written.DIt cannot be placed: LNK times are not reliable.
   Check

5. Q052 pointslnk-files.csvpartition-diagnostic.csv

   How many shortcuts in the Recent folder point to the unapproved stick's volume?Whole number
   Check

6. Q062 pointslnk-files.csv

   The shortcut to E:\Yedek\Projeler\TRB-2026\TRB-2026-Teklif-Fiyatlandirma.xlsx has TargetCreated 2026-08-28 16:44:51 and TargetModified 2026-08-21 13:07:40. What does that pair say?

   AThe clock was wrong: a file cannot be modified before it was created.BThe file was written on E: on 28 August, and its content was last changed on 21 August: the pattern a copy leaves, because copying keeps the modification time and sets a new creation time.CThe file was created by the user on the stick and edited there a week earlier.DThe shortcut was copied from another computer.
   Check

7. Q072 pointsshellbags.csvlnk-files.csv

   ShellBags show My Computer\E: first interacted on 2025-06-11 and E:\Teslim on 2026-08-19. Can ShellBags alone say which device E:\Yedek was on?

   AYes: E: is always the same stick on one computer.BYes: the BagMRU key stores the device serial number.CNo: ShellBags record the drive letter and the folder path, not the device. The volume serial number in the shortcuts (7A3E-11C2) and the stick sessions in 1006 tie E:\Yedek to the SanDisk.DNo, and nothing else in the pack can either.
   Check

8. Q082 pointsproxy-log.csv

   How many uploads to the personal cloud service upload.bulutkutu.example succeeded?Whole number
   Check

9. Q092 pointsproxy-log.csv

   When was the first successful upload to the personal cloud? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

10. Q102 pointsprint-log.csv

    How many pages did e.demir print on 14 September (UTC date)?Whole number
    Check

11. Q111 pointprint-log.csvexport-metadata.txt

    What does a PrintService 307 event let you say about the printed customer list?

    AIts full content as printed.BThat a document with that name was printed by that account from that computer on that printer, with its size and page count, and not what was on the pages or who took them.CNothing: print logs only record errors.DThat the pages were taken out of the building.
    Check

12. Q122 pointsvpn-sessions.csvsecurity-events.csv

    A Remote Desktop logon (type 10) reaches the workstation on Sunday 13 September. When did the VPN session that carried it start? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

13. Q132 pointssecurity-events.csv

    From which address did the Sunday Remote Desktop logon come?IPv4 address
    Check

14. Q142 pointsvpn-sessions.csv

    How many successful VPN sessions did e.demir start at a weekend or between 20:00 and 07:00 local time?Whole number
    Check

15. Q152 pointsvpn-sessions.csvik-kaydi.txt

    vpn-sessions.csv ends with 16.09.2026 10:02:44, e.demir, 203.0.113.140, FAIL, account disabled. What should the report say?

    AThe user broke in after leaving.BThe log is unreliable: the account was already disabled.CA connection was attempted with e.demir's credentials 15.5 hours after the account was disabled, from an address not seen before; it was refused and no session was established. Who made it is not shown.DNothing: failed attempts are noise.
    Check

16. Q162 pointslnk-files.csvproxy-log.csvprint-log.csvvpn-sessions.csv

    Which sentence can the examiner sign?

    Ae.demir gave the customer contact list to Kuzey Tasarım Ltd.BNo data left: the approved stick was returned and the account was disabled on time.CBetween 28 August and 14 September, under e.demir's account, copies of the customer contact list and project and price files were written to an unapproved stick (serial 4C530001050719102233), 38 files were uploaded to a personal cloud account and 212 pages were printed after hours; a Sunday VPN session carried a Remote Desktop logon and file share browsing. Where the copies went after that is not shown by these records.DThe employee planned the theft before resigning, as the 28 August copy proves.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis; the VPN report and the HR record are converted from local time.
• The stick is tied to files by volume serial number, and the approved stick's files are kept apart.
• Counts state their filter: successful uploads only, one user's pages on one date.
• Each channel is placed against the notice, the last day and the disabling of the account.
• The report says 'under the account', names no recipient and lists what was not examined.

How findings are phrased →