3
Shared Docs
3
Same-Page
3 / 3
Mentions
s Recover Folders for Z6E8M349 Completed Successfully Process Recover Folders for Z6E8K1EV Completed Successfully Export Logical Evidence File of Michael Thomas user's profile (bop19012) on Z6E8M349 Named BOP19012.L01 Export Logical Evidence File of Tova Noel user's profile (bop61232) on Z6E8K1EV Named BOP
APPS/Roster/Ver3.1/Roster.accde file:///I:/GROUPS/SHAREDOC/SHU PAPERWORK, LOCATOR, HARDCOPY/1 - SHU LOCATOR 2019(HARDCOPY).docx Google Search for "suzuki gsx-r 1000 motorcycle for sale" 8/10/19 01:00:52 Google Search for "suzuki gsx-r 750 motorcycle for sale" on 8/10/19 01:00:52 Bing Search for "cycletrade
Timeline Analysis of Desktop Property # 0214 207268 HDD Image Z6E8M349.E01 (Device 1) Important Identifiers: User: Michael Thomas Username: BOP19012 SID: S-1-5-21-1823249720-3210992811-1527010081-1102 SID: Microsoft Security Identifier Date Time Action 8/10/2019 0:36:
1 User navigates in IE to "https://www.cycletrader.com/myt/saved-listings/myListings?_=1565413229430" 8/10/2019 1:00:52 User searches Google for "suzuki gsx-r 750 motorcycle for sale" 8/10/2019 1:00:54 User navigates in IE to "https://www.cycletrader.com/Suzuki-Gsx-R-750/motorcycles-for-sale?type=motorcy
/10/2019 6:19:05 59 8/10/2019 6:29:07 60 8/10/2019 8:55:12 EFTA00131525 1 Timeline Analysis of Desktop Property !I (Device 1) _ 2 3 4 Michael Thomas 5 6 7 Microsoft Security Identifier 8 9 _ &gm 10 User BOP19012 Successfully Logged onto the System — 11 _ User launches GroupWise (grpwis
cletrader.com/" 38 User navigates in IE to "https://yAvw.cyctetrader.com/myt/saved4istings/myListings?_•1565413229430" 39 User searches Google for "suzuki gsx-r 750 motorcycle for sale" 40 User navigates in IE to "https://www.cycletrader.com/Suzuki-Gsx-R-750/motorcycles-for-sale?typeumotorcycle%7C356953&make
Entities connected to both Michael Thomas and suzuki gsx-r