Eli Lab

A user reported strange browser behavior and missing files on their Chromebook. SOC analysts suspect unauthorized access and data theft. You’ve received a forensic image for review. Investigate user activity, application data, and browsing artifacts to uncover what happened.Resources:Hindsight from Ryan Benson: https://github.com/obsidianforensics/hindsightChromebook Data Locations: https://www.magnetforensics.com/blog/chromebook-data-locations/Taking a Byte out of Chromebook Analysis: https://www.magnetforensics.com/resources/taking-a-byte-of-chromebook-analysis-mvs-may-5/Ross Donnelly on Google Takeout Location Data: https://dfir.pubpub.org/pub/d39u7lg1/release/1Takeout Locations: https://www.magnetforensics.com/resources/targeted-locations-quick-reference-guide-for-android-and-google-takeouts/