lyze its contents. Among the tests that were conducted using ILook was
a search for the keywords “boatingct” and boatingct.com, which was
conducted on the free space and the slack space of the imaged hard
drive. Data related to the intrusion at BoatingCT.com were recovered
from the free space on the imaged hard drive. Samples of the recovered
data are shown in Figures 6-8 through 6-11. Evidence that he had tried
to sell the stolen customer credit cards also was retrieved from the
imaged drive. Figures 6-12 and 6-13 show e-mails sent by the student
(using the e-mail address daspang24@yahoo.com) for the purpose of
selling the stolen cards.
Arrest and Sentencing
On June 13, 2002, the University of Akron student entered a guilty plea
to one count of Title 18 US Code 1030 a(4) (“Fraud and related activity
in connection with computers”). In so doing, he admitted to “know-
ingly and with the intent to defraud, access a protected computer, without
Arrest and Sentencing 175
FIGURE 6-7
Remains of the student’s master drive.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
38190_CH06_FINAL_.qxd 3/25/06 8:42 AM Page 175
176 Case 6 FBI New Haven Field Office—CART
ORDERNUM: WEB1 1712
DATE: 04/30/01 19:20
Billing - First Name = Beverly
Billing - Last Name = C
Billing - Attention=
Billing - Address 1 = 3 Land Point Rd.
Billing - Address 2 =
Billing—City = Lotburg
Billing - State = VA
Billing - ZIP = 22333
Payment - Method = American Express
Payment - Card Name = Beverly A. C
Card Number = 1234 5678 1234 5678
Payment - Card Exp = 11/02
—————————————————————————
Items Ordered:
Catalog Item Number: 5033
Model Number: BVret
Description: 3/4" fitting
Quantity: 2
Net Each: 58.79
FIGURE 6-8
One of the BoatingCT.com customer order records retrieved
from the student’s computer.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
38190_CH06_FINAL_.qxd 3/25/06 8:42 AM Page 176
authorization to obtain credit card information. He also admitted to
preparing and sending fraudulent e-mail messages to the company’s cus-
tomers to obtain additional financial information, and to using some of
the credit card and financial information for his own personal gain. His
arraignment took place in the United States District Court, District of
Connecticut, in downtown New Haven. A loss figure of $335,000 was
stipulated, determined on the basis of the number of credit cards he stole
(670) multiplied by the minimum implied loss per credit card ($500). He
Arrest and Sentencing 177
Dear Mr. or Mrs. G,
We apologize for any inconvenience this may cause you, but our system has
flagged your order most likely due to an unauthorized credit card transaction.
Ordernum: WEB11341
Visa: XXXX-XXXX-XXXX-0421
Exp: 11/02
In order for your items to be shipped we first need some verification. For our
safety and security, BoatingCT requires that you respond back with your
card’s verification number, if one is available. The verification number is a
3-digit number printed on the back of your card. It appears after and to the
right of your card number.
The second method is bank account verification in case fraudulent credit card
information was provided. We require the routing number, which is located at
the bottom of your check in between the |: and |: symbols, as well as the
account number which comes before the ||’ symbols. Exact location and
number of digits varies between banks.
All information is private and confidential. Again, we apologize for any
inconvenience and hope you continue to shop with us in the future.
FIGURE 6-9
Text of e-mail message sent to a BoatingCT.com customer
retrieved from the student’s computer.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
38190_CH06_FINAL_.qxd 3/25/06 8:42 AM Page 177
was sentenced to twelve months in prison and required to pay $20,000
in restitution to BoatingCT.com. On October 22, 2003, he was released
from prison after serving approximately six months of his sentence. The
case was officially closed on February 23, 2004.
178 Case 6 FBI New Haven Field Office—CART
F
IGURE 6-10
BoatingCT.com customer e-mail responses retrieved from the
student’s computer.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
38190_CH06_FINAL_.qxd 3/25/06 8:42 AM Page 178
Appendix A 179
FIGURE 6-12
The student’s e-mail to sell stolen customer credit cards
retrieved from his computer.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
FIGURE 6-11
The student’s test message and response to himself retrieved
from his computer.
Source: Special Agent/CART field examiner, FBI New Haven Field Office, January
21, 2005.
38190_CH06_FINAL_.qxd 3/25/06 8:42 AM Page 179

Get Information Security: Contemporary Cases now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.