JLane Week 6 Forensic Report

Forensic Analysis Report Case Number: 18CSP01234 Suspect: Christina “Tina” Oodle Examiner: Janielle Lane Agency: Champlain College Police Department Date of Report: Week 6 – October 8, 2023

Case Information: Department: Champlain College Police Department Incident Number: 18CSP01234 Investigator: Janielle Lane Victim: Walter Emerson Suspect: Christina “Tina” Oodle Date of Incident : 5/12/2018 Location: Burlington, VT area Nature of Incident: 13 V.S.A. § 2002 – False Pretenses Attachments: Chain of custody documentation; Copy of Evidence Handling Protocols; Evidence images Evidence: Evidence Number Item Name Size Description 3 Seagate Momentus.E01 49.68 GB Forensic image of Hard Drive 4 Toshiba Laptop DESKTOP-T5DSQ80 Initial Complaint: Walter Emerson presented to the CCPD at approximately 1600 on May 16,2018. He wished to file a report regarding $1,500 missing from his Bank of Vermont checking account. Mr. Emerson noted the transactions when reviewing his bank statement. One check for $500 was cashed at “Burlington Check Cash”, and the other check for $1,000 was cashed at a business in Winooski. Mr. Emerson reports never visiting either of these locations at any point in the past. Mr. Emerson reports that he recently made friends with an individual online that he has been communicating frequently with through both e-mail and Facebook from May 1, 2018 until approximately May 12, 2018. This individual, believed to be Christina “Tina” Oodle, had mentioned financial struggles to Mr. Emerson in the past, and he had subsequently mailed her checks on three separate occasions; two checks in the amount of $75 each, and one for $275. Mr. Emerson reports that upon receipt of the last check, he has not been able to connect with Ms. Oodle via any method. He reports that she is the only other individual who could have access to his account information. On May 15, 2018, Officer Jackson responded to a call for possible theft at City Market. Upon responding, Officer Jackson was given a description of the suspect, who had since fled the scene, 2

 System/Network settings  User profiles  Transactions  Search history  E-mail  Socia Media  Saved files – documents/images etc.  Downloads Forensic Software Used: Software Version Magnet Axiom Examine V5.10.0.30634 Autopsy 4.19.13 XWays Forensics Summary of Findings: Utilization of the abovementioned forensic tools provided insight into the hard drive located within the Toshiba laptop (Seagate Momentus.E01), taken into custody at the time of Ms. Oodles’ arrest on 5/15/18. The first utilization of the hard drive was 4/29/18, which is right before the interactions between Ms. Oodle and Mr. Emerson began. Review of user accounts showed just one primary user account, named “Tina”, which had social media data linked to the account previously identified to belong to Ms. Christina “Tina” Oodle ( www.facebook.com/tina.oodle5 ), e-mail data from an account that has previously been identified as being registered to Ms. Christina “Tina Oodle ( tinalovestocook6@gmail.com ), and all browser data, including downloads, were under this account. This solidifies that Ms. Oodle is indeed the owner and sole user of this hard drive. Frequent communication between Mr. Emerson and Ms. Oodle was also present on the hard drive, including those where Ms. Oodle mentioned financial difficulties, and Mr. Emerson offered to send her money. Analysis of the hard drive provided information linking Ms. Oodle to the placement of the flyer that first led to Mr. Emerson contacting her. The PDF for the flyer was found to be saved on the desktop, and the browser search history showed a Google search for “Where can I post flyers in Burlington Vermont”. Review of Google Maps data also found a driving route from 220 Flynn Avenue, Burlington VT to a few local businesses, including Brigantes, where Mr. Emerson reported that he found the flyer. Review of the Google browser history showed searches for such topics as “Anatomy of a Check”, from 5/6/18 at 1731, “hot new scams 2018”, from 4/29/18 at 1642, and “how much does a truck driver make”, from 5/6/18 at 1741, just to name a few. There was also history of a YouTube video called “How to Conduct a Romance Scam”, from 4/29/18 at 1645. Review of the documents saved on the hard drive include not only the flyer mentioned above, but also a blank check template document that matches those that were taken into possession at the time of Ms. Oodles’ arrest. Included in this document were the checks that were cashed from Mr. Emerson’s checking account; numbers 185 and 186. Previous analysis of Google account data for the e-mail address connected to Ms. Oodle provided an IP address that was sourced back to Paris, France (104.156.210.171). An application 4

called “NordVPN” was found to be installed on the system, and that it was first accessed on 4/29/18 at approximately 1526. This program is designed to mask a user’s IP address, and with the location of Ms. Oodle being in Burlington, VT, and the IP being found in Paris, France, shows her intent to use the VPN in an attempt to hide her online movements. Analysis and Exhibits: Seagate Momentus.E01 – Operating System, User profiles, Documents, Media, E-mail, Social Networking, Downloads, Browser history Encryption, Communication  Approximately 177,519 digital artifacts Evidence Description Seagate Momentus.E01 was forensically imaged from the hard drive of the Toshiba laptop found in Ms. Oodles’ backpack at the time of her arrest. The hard drive had 49.68GB on it at the time of imaging. The laptop was named DESKTOP-T5DSQ80 (per the hard drive analysis), and was in relatively new condition. There were some minor scuffs, scratches, or other types of damage noted on the laptop, which could be attributed to frequent travel within the backpack without a protective sleeve/covering. All components appeared to be intact/not tampered with. The laptop was running Windows 10 Education, and was set to EST. The forensic image, Seagate Momentus.E01, has the following hash value: 9C191B13756E36131E2919A6A0713724 (located using XWays Forensics). Per AXIOM, there were 177,519 digital artifacts located on the hard drive. Examination of Evidence Seagate Momentus.E01 This forensic image was analyzed using three separate forensic applications; XWays Forensics, AXIOM, and Autopsy. All three programs were found to be updated to the newest version, and were tested prior to use for this analysis. In regards to determining the owner/primary user of the system, the user account that was the primary one used was called “Tina”. Review of the data under the user profile included e-mail communication from the known e-mail of Ms. Oodle ( tinalovestocook6@gmail.com ), and all Facebook data was found to come from the account that is known to be registered to Ms. Oodle ( www.facebook.com/tina.oodle5 ). There is no other activity under the other accounts on the account (Guest, Admin, or Default). The culmination of this information supports that Ms. Oodle is the owner, and sole user of the laptop that houses the hard drive being analyzed. A program called “NordVPN” was downloaded to the system on 4/29/18 and was used on the following days: 4/29 and 4/30; 5/1, 2, 4, 6, 8. 9, 10, 11, 12, 13. All of these days, except 5/13/18, 5

Oodle. Per the metadata viewed through XWays Forensics, this document was created on 4/29/18 at 1652, and a Google Map route for local restaurants, including Brigantes where Mr. Emerson came across the flyer, was saved to the system at 1646. A blank check template was downloaded and saved on 5/12/18, and from that template, the checks found in the possession of Ms. Oodle were derived. That document was created on 5/12/18 at 2034, and had layouts for checks number 185 through 191. Checks numbered 185 and 186, matched those that were fraudulently cashed from Mr. Emerson’s account. Overall, the analysis of the hard drive came back with nothing else of significance except it is important to note that there is not any evidence of Ms. Oodle communicating with any other individual, limiting the likelihood of her working in conjunction with another individual. Evidence of Ownership The primary user account utilized on the system is labeled “Tina”, and is the only one with any web search data, communication history, and other signs of use. All search history was in relation to romance scams, local restaurants, and multiple sites in relation to check printing, and both her e-mail address and Facebook account were the only ones accessed. The other user accounts, “Administrator, Guest and Default”, did not have data associated with them. Timeline Analysis 4/29/2018 First use of the computer by Ms. Oodle – e-mail and Facebook set-up DESKTOP- T5DSQ80 4/29/18 Poster,pdf – “Single?”…with Tina’s contact information – same one Mr. Emerson reported responding to Seagate Momentus.E01 – Saved Documents 4/29/18 Check Layout Design.pdf – instructions on how to design/adjust checks Seagate Momentus.E01 – Saved Documents 4/29/18 Directions to post flyers – Google Maps Seagate Momentus.E01 – Saved Documents 4/29/18 Google Searches  “what is my ip address?”  “hot new scams 2018”  “where can I post flyers Burlington Vermont?”  “how to get money quickly” Seagate Momentus.E01 – Chrome search history 4/29/18 Download and installation of NordVPN Seagate Momentus.E01 - Applications 4/29/18 https://en.wikipedia.org/wiki/Romance_scam Seagate Momentus.E01 – Browser History 5/6/18 https://www.checksconnect.com/htm/anatomyOfACheck.htm- looking - researching the anatomy of a check Seagate Momentus.E01 – 7

Browser History 5/6/18 Google Search – “how much does a truck driver make” Seagate Momentus.E01 – Chrome search history 5/12/18 Google Search – “gimp photo editor” Seagate Momentus.E01 – Chrome search history 5/12/18 Download of GIMP photo editor - http://download- hr.utorrent.com/track/stable/endpoint/utorrent/os/windows Seagate Momentus.E01 – Browser History 5/12/18 First download of check image template by Tina Seagate Momentus.E01 – Downloads 5/12/18 Creation of blank checks numbered 184 – 191, with a typed signature of “Walter Emerson” Seagate Momentus.E01 – Documents Closing Comments / Conclusions Review of the evidence provided, and the subsequent analysis in conjunction with the information provided in the previous report submitted on 9/19/23, there is credible evidence that Ms. Christina “Tina” Oodle has committed False Pretenses, in violation of 13 V.S.A. § 2002 . The blank checks, and the hard drive in the laptop found in the possession of Ms. Oodle at the time of her arrest on 5/15/18 provides probable caused that this crime was conducted against Mr. Walter Emerson. The evidence outlined in this report shows the ownership of the laptop seized to Ms. Oodle, as well as evidence of her researching such topics as blank checks, romance scams, photo editing, VPN use, and the anatomy of a check. Communication between Ms. Oodle and Mr. Emerson confirmed on this device matches that found on the device previously analyzed that is owned by Mr. Emerson. Compilation and review of all the information thus far in this case, and all digital evidence analysis, supports the belief that Ms. Oodle is the suspect in reference to case #18CSP01234. Analysis Start: 10/1/23 Analysis End: 10/3/23 End of report. 8