01 / Context
A simulated trafficking case handled as a structured investigation.
The scenario focused on a drug-trafficking operation between Australia and New Zealand. Three digital systems were provided for analysis: John Fredricksen’s laptop, Jane Esteban’s laptop and Steve Kowhai’s desktop.
The goal was not only to extract files. The work was to connect artefacts, understand each actor’s role and rebuild a coherent, defensible narrative.
02 / Scope
Three systems, multiple types of digital artefacts and a process of cross-checking evidence.
two laptops and one desktop
files, caches, processes, network traces
coordination, surveillance, concealment
The scope covered system artefacts, Discord caches, steganography-related elements, deleted files, malware indicators and all the traces needed to rebuild a reliable sequence of events.
03 / Method
A simple workflow: collect cleanly, examine, correlate, then report.
Collection
Work based on disk images and memory captures provided as part of the scenario.
Examination
Explore file systems, recover artefacts and inspect volatile memory.
Analysis
Correlate clues across devices to confirm roles, links and the sequence of actions.
Reporting
Produce a structured report presenting findings, limits and conclusions.
Disk analysis
Autopsy and FTK Imager for files, metadata, browser traces and cached communications.
Memory analysis
Volatility for processes, network sessions and malware-related evidence in RAM.
Cross-checking
Compare evidence across devices, communication logs and time-based artefacts before drawing a conclusion.
04 / Findings: from evidence to conclusion
The investigation becomes understandable when artefacts from several systems converge on the same story.
Recovered exchanges provide the context needed to link files, timestamps and actions to specific people.
Steganography matters because it aligns with conversations, recovered files and the wider timeline rather than standing alone.
Autopsy and memory artefacts on Jane Esteban’s machine are consistent with surveillance activity targeting John Fredricksen’s system.
Browsing, communications, files, memory and metadata converge enough to rebuild roles and sequence.
05 / Timeline
A timeline rebuilt from digital traces.
Recovered messages, browsing history, downloaded files, steganography-related artefacts and memory activity were aligned to reconstruct the sequence of actions: preparation, communication, concealment attempts and logistical coordination.
- Preparation and exchanges between actors through Discord.
- Research and use of steganography tools to hide information inside images.
- Quasar RAT-related elements in the context of surveillance against John Fredricksen.
- Consistency between traces recovered on the three devices and the scenario narrative.
06 / Complementary labs
The focused labs follow the same logic: start from a technical trace and explain what it establishes.
MFTECmd, Timeline Explorer and Autopsy recover a downloaded ZIP, its origin through Zone.Identifier, then related browsing and autofill traces.
Memory analysis identifies youtube_downloader.elf, its processes, the persistence path /usr/bin/nettstat, remote IP 64.23.144.215 and attacker-created account systemservice.
In the Nitroba PCAP, source IP, DNS queries, HTTP cookies and MAC address converge on Johnny Coach as the sender of the harassing emails.
07 / Conclusion
The common thread across these DFIR exercises is correlation: one artefact is rarely enough.
NARCOS-2019 and the complementary labs taught me how to move from scattered technical artefacts to a timeline and evidence-based explanation. The value lies as much in evidence integrity and cross-checking as in the tools used to extract it.
This practice reinforces how I approach data in general: verify the source, preserve traceability, separate observation from interpretation and build only the conclusions the evidence can support.