Computer forensics: 2009 m57 scenario (Data Set)

The M57 Patents realistic forensic data corpus. Production supported by NSF DUE-0919593.

This scenario involves a small company called M57 which was engaged in prior art searches for patents. The fictional company is contacted by the local police in November 2009 after a person purchases a computer from Craigslist and discovers "kitty porn" on the computer. The police trace the computer back to the M57 company.

The scenario actually involves three separate criminal activities:

1. Exfiltration of proprietary information by an M57 employee.
2. Stealing of M57's property and selling it on Craigslist.
3. The possession of "kitty porn" photos by an M57 employee.

This is an involved scenario which has the following information available to students trying to "solve" the case:

1. Disk image of the computer that was sold on Craigs List
2. Disk images of the firm's five computers when the police show up.
3. Disk images of the four USB drives that were found on-site belonging to M57 employees
4. The RAM image of each computer just before the disk was imaged.

There are approximately 2-4 weeks of use on each computer.

For more information, see forensicswiki.org.