Complete 2012 forensic audit documents - Kansas Bioscience ...

Mr. Abdullah contacted BKD via email on April 26 th and indicated that he had received the
computer. BKD forensically imaged the computer on April 26, 2011.
Forensic tools are capable of extracting formerly deleted files as well as a host of residual data
(such as Internet-based email, chat, document fragments, etc.) and operating system artifacts that
provide evidence of user activities from the free space of a computer. Free space or “unallocated
space” is the area of the hard drive not currently in use for active files. It is the area on the hard
drive where deleted information not overwritten in the normal use of the computer may reside.
This type of information is commonly utilized in internal investigations where allegations of
abuse or misuse of assets or funds have been made.
Forensic analysis of Thornton’s KBA-owned computer indicated that information had been
removed from the computer, essentially all of the user-created content had been deleted, and that
the free space had been wiped making the recovery of deleted items impossible. This occurred
before the computer was returned to KBA. Forensic analysis revealed the following:
• On April 21, 2011, a USB device was connected to the computer. USB devices are
commonly used to transfer files between computers and other media storage devices.
• On April 21, 2011, the control panel applet “Add or Remove Programs” was last
accessed. This applet can be used to delete programs from a computer.
• On April 21, 2011, RegEdit (Microsoft Windows Registry Editor) was run. RegEdit can
be used to remove the path to specific programs after they have been removed through
the “Add or Remove Programs” applet.
• On April 22, 2011, at 8:23 a.m. CCleaner was run. CCleaner is a computer cleanup tool
that cleans a number of common areas that track user activity. Analysis of user activity
areas on the computer such as the Internet Cookie Directory, the Temporary Internet File
Directory and the Recent Files folder shows those directories to be empty. CCleaner also
has the ability to wipe Free Space.
• On April 22, 2011, at 8:42 a.m. Eraser was installed on the computer and was run twice.
Eraser is a Free Space and drive wiping tool which can wipe individual files as well as
Free Space.
• On April 22, 2011, at 10:12 a.m. the computer was last shut down.
• On April 25, 2011, the computer was placed with United States Postal Service Express
Mail for shipment to KBA.
While some evidence has been recovered that illustrates the former existence of files and folders
on the laptop, a typical characteristic of wiping tools is that they do not provide a log of exactly
what was erased or cleaned. Therefore, a complete quantification of what activities, files and
folders existed on the computer prior to the use of the wiping tools is not possible. Importantly,
BKD cannot determine whether or not Thornton’s KBA-owned computer held any possible
evidence of misuse or abuse of KBA assets or funds such as the improper granting of funds to
client companies; the improper contracting of any vendor or consultant; the preferential
treatment or payment of any vendor or consultant; or the improper payment or reimbursement of
expenses of any current or former KBA employee or BOD member.
101