Eli Lab

A user reported strange browser behavior and missing files on their Chromebook. SOC analysts suspect unauthorized access and data theft. You’ve received a forensic image for review. Investigate user activity, application data, and browsing artifacts to uncover what happened. Resources: Hindsight from Ryan Benson: https://github.com/obsidianforensics/hindsight Chromebook Data Locations: https://www.magnetforensics.com/blog/chromebook-data-locations/ Taking a Byte out of Chromebook Analysis: https://www.magnetforensics.com/resources/taking-a-byte-of-chromebook-analysis-mvs-may-5/ Ross Donnelly on Google Takeout Location Data: https://dfir.pubpub.org/pub/d39u7lg1/release/1 Takeout Locations: https://www.magnetforensics.com/resources/targeted-locations-quick-reference-guide-for-android-and-google-takeouts/ Takeout Data: https://www.magnetforensics.com/resources/exploring-the-data-available-from-google-takeout-webinar-sep-22-oct-6/