Insider Threat Forensics by New World Forensics
New World Forensics, an A+ BBB-rated leader in digital forensics, tackles insider threat cases with advanced tools and a proven methodology. Their approach uncovers critical evidence, distinguishes malicious intent from innocent actions, and delivers actionable results.
Forensic Methodology
New World Forensics employs a streamlined, multi-phase process using tools like Cellebrite UFED, Magnet AXIOM, and EnCase Forensic:
Data Acquisition: Experts extract mobile data with Cellebrite UFED or create forensic images with EnCase, preserving evidence and chain of custody.
Analysis: Magnet AXIOM’s AI analytics correlate data across devices, identifying patterns like unauthorized transfers. Custom scripts and Volatility analyze memory for hidden processes.
Reporting: Clear, court-ready reports with AXIOM and EnCase visualizations map timelines and user actions for non-technical stakeholders.
Key Artifacts in Insider Threat Cases.
New World Forensics targets artifacts to reveal user behavior and intent:
Email/Messaging Logs: Extracted via Cellebrite or AXIOM, these expose data exfiltration or collusion (e.g., emailing sensitive files).
File Access Records: EnCase recovers metadata and logs (e.g., Windows Event ID 4663) showing unauthorized file access.
USB Usage: AXIOM tracks USB activity via registry keys (e.g., USBSTOR), revealing data transfers to external drives.
Browser/Cloud Logs: AXIOM analyzes visits to file-sharing sites or cloud uploads (e.g., OneDrive), tracing sensitive data movement.
Deleted Files: EnCase and Volatility recover deleted documents or detect anti-forensic tools like CCleaner, confirming intent.
Application Usage: Windows FeatureUsage keys prove user activity during suspicious events, debunking alibis.
Driving Case Resolution
Correlated artifacts build a narrative. For example, file access logs, cloud syncs, and USB artifacts might expose an employee stealing proprietary code, with memory analysis confirming cover-up attempts. This evidence pinpoints perpetrators and quantifies breaches for legal or disciplinary action.
New World Forensics’ expertise, powered by Cellebrite, AXIOM, and EnCase, transforms raw data into compelling evidence. Their A+ BBB rating underscores their commitment to safeguarding organizations against insider risks with precision and integrity.
