Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

What Can You Learn From a “Wiped” Computer With Digital Forensics?

Summary: Unit 42 describes two insider cases where digital forensics recovered evidence from laptops reported as "wiped": in one, an ex-employee accessed code reviews, rollout plans and other proprietary information from thumb drives while connected to a competitor's network days after resigning, and installed a remote access tool that took an incoming connection from an IP resolving to an outsourced technician's remote location seconds before mass deletions occurred. In the other, a departing employee connected his work Mac to a personal iCloud account, synchronized folders of proprietary data, deleted those folders days before resigning, and the data was backed up to a personal time capsule around the same time.

What you should know: The term "wipe" covers everything from simple deletion to repeated overwriting, and examiners say they can often still recover deleted files and artifacts showing when and how wiping happened - so a returned laptop is evidence, not a closed case.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related