Daily Blog #154: Sunday Funday 11/24/13 - Finding the Culprit Challenge

Finding the Culprit Challenge by David Cowen - HECF Blog

Hello Reader,
        It's Sunday Funday time! Let's get into some more real world scenarios and combine some different types of analysis.

The Prize:
  • A $200 Amazon Gift Card
The Rules:
  1. You must post your answer before Monday 11/25/13 2AM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful 
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:

Your board of directors have received an email from a Gmail address sent from Thunderbird mailer at 9pm at night with insider information about the company with a demand for action or the sender will go to the press.  IT security has found the IP address of the companies firewall of one of the smaller company branches in the email header and passed the data to you. The branch has only 8 employees and normal office hours end at 5pm.

Please detail how you will:
1. Determine which system sent the email
2. Determine which user of the system sent the email

Good luck!

Also Read: Daily Blog #153

Post a Comment