You are a forensic analyst subcontracted with the Delaware Department of Homeland Security. Officer Kyle of the Kent County Police Department found a laptop from a suspicious person during a
vehicle stop. The suspect led Officer Kyle on a pursuit and momentarily evaded law enforcement personnel; Kent County Police officers located the suspect approximately 45 minutes later in a wooded
area near the Senator William V. Roth, Jr. Bridge. The laptop was never recovered, but a 8GB USB Thumb Drive was found in the suspect’s socks. Officer Kyle was assigned to examine the thumb drive
in relation to possible terrorist activity. Officer Kyle executed a search warrant on Colette Winkle’s thumb drive. Officer Kyle created a forensic image of the thumb drive.
Officer Kyle confirmed that MD5 hash value of the image to be the following:
564495b19a1f0bef5984cb604e73614d
Due to personal matters, Officer Kyle is no longer able to perform a forensic exam on the suspect’s thumb drive. The case has been turned over to you.
It is your duty to prove/disprove the claim that Colette Winkle’s thumb drive possesses any terrorist material along with standard forensic practice such as identifying viruses, file ownership,
etc.
Officer Kyle interviewed Colette Winkle at the scene and requested her login credentials. Colette Winkle informed Officer Kyle that she wants an attorney.