Rebuttal report: unauthorised access to a computer and a server?
Technical review of an earlier report alleging improper access to an employee's computer and an organisation's server.
Background
A sports club suspected that, within a specific time window, someone had accessed an employee's computer and the server hosting its membership and accounting software without authorisation. An earlier technical report took this for granted.
What I was asked
To determine whether there was solid technical evidence of such access and to review the earlier report's conclusions.
How it was analysed
- On-site examination of the computer and the server.
- Analysis of the Windows Event Viewer (system and security logs) for the time window, using successful and failed logon event IDs.
- Review of Remote Desktop (Terminal Services) access to the server.
- Point-by-point comparison with the earlier report's claims.
Report findings
No sufficient or conclusive evidence was found of any access, legitimate or unauthorised, to either machine during the period in question. Remote access to the server was technically possible but highly unlikely under the circumstances.
Key takeaway
Suspicion is not evidence. Operating system logs can confirm or rule out access, and a well-founded rebuttal report can prevent an unfair accusation.
Related service: Expert reports on cybersecurity incidents and computer fraud
Anonymised case. Personal data, the parties and procedural references have been omitted or altered to preserve confidentiality.