Digital Forensic Investigation of Unauthorized Image Upload and Potential Log Tampering on College Web Application Infrastructure

# Digital Forensic Investigation Report ## Incident Overview The Information Security Team received reports that unauthorized and inappropriate photographs had been uploaded to the official college web application. The uploaded content was not associated with any approved academic or administrative activity. A forensic investigation was initiated to determine: - Source of the uploaded files - Identity of the uploader - Method of access - Scope of compromise - Whether evidence had been intentionally destroyed --- # Initial Findings The investigation confirmed: • Unauthorized image files were present on the production web server. • The files were not approved by authorized college staff. • Upload timestamps indicate the files were uploaded outside normal administrative operations. • No approved maintenance activity was scheduled during the relevant period. --- # Evidence Collected ## Server Evidence Collected: - Web application files - Uploaded image directory - Database backup - Operating system metadata - User account information - Scheduled tasks - IIS/Apache/Nginx configuration Observed: - Missing access logs - Missing upload logs - Missing authentication records - Missing audit records --- ## Network Infrastructure The following network devices were examined: - Core Router - Firewall Appliance - Wi-Fi Controller - Wireless Access Points Observed: - Router logs unavailable - Firewall logs unavailable - Wi-Fi authentication logs unavailable Log retention records indicate the expected data should normally have been available for the investigation period. --- ## Log Integrity Assessment The following log sources were unavailable: - Web Server Access Logs - Web Server Error Logs - Operating System Security Logs - Firewall Logs - Router Logs - Wireless Authentication Logs The simultaneous absence of multiple independent log sources is considered unusual and significantly impacts forensic reconstruction. --- # Timeline Reconstruction | Time | Event | |-------|-------| | T0 | Unauthorized image uploaded | | T1 | Web application records modification | | T2 | Multiple logging sources no longer available | | T3 | Incident reported by college staff | | T4 | Digital forensic investigation initiated | --- # Forensic Analysis ## Uploaded Files Analysis performed: - SHA-256 hashing - Metadata extraction - EXIF examination - File signature validation - Creation and modification timestamps No evidence was found that the files originated from routine application processes. --- ## Server Analysis The forensic examination included: - User account review - Login history - Scheduled task analysis - Privilege assignment review - Service account analysis Administrative-level permissions were required to manage application files and server logging configuration. --- ## Log Deletion Analysis Evidence indicates that several categories of logs were unavailable during the investigation. Potential explanations include: - Manual deletion - Log rotation misconfiguration - Automated cleanup - Storage failure - Administrative maintenance Further forensic examination is required to determine the exact cause. --- # Persons of Interest Based on current evidence, investigators identified accounts possessing administrative privileges capable of: - Managing uploaded files - Accessing production servers - Modifying log retention settings - Deleting audit records At this stage, privileged administrative accounts—including the system administrator account—are considered persons of interest due to their level of access. No determination of individual responsibility has been made. --- # Indicators of Potential Anti-Forensic Activity The investigation identified indicators consistent with possible anti-forensic behavior, including: - Missing web server logs - Missing firewall logs - Missing router logs - Missing Wi-Fi authentication logs - Reduced ability to reconstruct the incident timeline These observations warrant additional forensic examination but do not independently establish intentional evidence destruction. --- # Impact Assessment Potential impacts include the following: - Unauthorized publication of inappropriate content - Reputational damage to the institution - Loss of evidentiary records - Delayed incident response - Reduced attribution capability --- # Recommended Additional Investigation Investigators should acquire: - Complete forensic disk image - Memory capture (if available) - Active Directory logs - Backup server logs - Cloud service audit logs - ISP connection records - Switch MAC address tables - Endpoint forensic images of privileged administrator workstations --- # Recommendations Immediate actions: 1. Preserve all remaining evidence. 2. Disable unnecessary privileged accounts. 3. Rotate administrative credentials. 4. Enable centralized log collection (SIEM). 5. Configure immutable log storage. 6. Increase log retention periods. 7. Implement multi-factor authentication for administrative access. 8. Review least-privilege access controls. 9. Perform a full compromise assessment. 10. Maintain chain of custody for all collected evidence. --- # Conclusion The investigation confirmed that unauthorized photographs were uploaded to the college web application. During the forensic examination, investigators found that several critical sources of evidence—including web server logs, Wi-Fi authentication logs, router logs, and firewall logs—were unavailable, preventing complete reconstruction of the incident timeline. The absence of multiple independent logging sources raises concerns regarding potential anti-forensic activity; however, additional evidence is required before attributing responsibility to any individual. Administrative accounts with sufficient privileges, including the system administrator account, remain subjects of further investigation until the forensic process is complete. This report reflects the findings available at the time of analysis and should be updated if additional evidence becomes available.