DIGITAL EVIDENCE COLLECTION
Re: Jackson Reed - Security Breach
Date of Breach: May 21-22, 2017
Compiled: May 23, 2017
Document 1: Email Received
From: vrose.reed@gmail.com
To: jreed.writes@gmail.com
Date: May 21, 2017 11:42 PM
Subject: I'm sorry
Jackson,
I can't sleep. I keep thinking about what I said and I'm sick about it. Comparing you to Mom was horrible. I know you're nothing like her.
I was drunk and scared and I lashed out at the one person who's always tried to protect me. Even when I fought you every step.
I wrote you a letter. A real one. Like we used to write when you were deployed. It explains everything I should have said tonight instead of the horrible things I did say.
Please read it. Please.
I love you.
Attachment: Letter_to_Jackson.pdf (247 KB)
Screenshot Log Files
C:\Users\JReed\AppData\Local\Temp\screenshot_cache
screenshot_052217_0947.png - Field Report #31 (re: "Jessica the yoga instructor")
screenshot_052217_0948.png - Field Report #35 (re: "cocktail waitress conquest")
screenshot_052217_0949.png - Field Report #47 (April client party)
screenshot_052217_0950.png - Field Report #48 (Irina Sterling encounter)
screenshot_052217_0951.png - Twitter DM inbox (full conversation list)
screenshot_052217_0952.png - Twitter DMs with @BookishBabe23
screenshot_052217_0953.png - Twitter DMs with @FitChick_Sarah
screenshot_052217_0954.png - Twitter DMs with @YogaJessica_OK
screenshot_052217_0955.png - Email draft: "Don’t Care, Got Laid"
screenshot_052217_0956.png - Charlie Stine investigation notes
screenshot_052217_0957.png - Irina Sterling background research
screenshot_052217_0958.png - Russian escort site cached files
[237 more screenshot files generated between 9:47 AM - 10:33 AM]
Windows Event Log - Suspicious Activity
Event ID: 4625
Time: May 22, 2017 09:45:22
Remote Desktop connection established
Source IP: 185.220.101.34 (Tor exit node)
Duration: 46 minutes
Processes launched during session:
Screenshot.exe
FileExplorer.exe
ChromePasswordDecrypt.exe
CompressFiles.exe
SecureDelete.exe
Document 2: Twitter Security Alert
Email from Twitter: noreply@twitter.com
Date: May 22, 2017 10:15 AM
Subject: New login to your account @HeForSheWrites
We noticed a new login to your account from an unrecognized device.
Device: Windows PC
Location: New York, NY
IP Address: [Masked]
Time: 10:15 AM EST
If this was you, please disregard this email. If this wasn't you, please secure your account immediately.
Document 3: Marcus Colton Text Exchange
May 22, 2017
Jackson [10:41 AM]: Something's wrong with my laptop
Marcus [10:42 AM]: Wrong how?
Jackson [10:43 AM]: Files keep opening on their own. Mouse moving without me touching it
Marcus [10:43 AM]: Dude disconnect from internet NOW
Jackson [10:44 AM]: Why?
Marcus [10:44 AM]: You're being accessed remotely. DISCONNECT NOW
Jackson [10:44 AM]: Fuck
Jackson [10:45 AM]: Pulled ethernet.
Marcus [10:46 AM]: What did you open recently? Any weird emails?
Jackson [10:47 AM]: ...
Jackson [10:47 AM]: V sent an apology letter last night. PDF attachment
Marcus [10:48 AM]: Call Victoria right now. Verify she sent it
Jackson [10:52 AM]: She didn't send it
Jackson [10:52 AM]: She has no idea what I'm talking about
Marcus [10:53 AM]: You got malwared bro. They have everything on your computer
Jackson [10:54 AM]: Who's they?
Jackson [10:55 AM]: Oh fuck. The field reports
Marcus [10:55 AM]: What field reports?
Jackson [10:56 AM]: Nothing. Fuck. FUCK.
[END EVIDENCE COLLECTION]
THEY know everything you do online. Privacy is a myth.