Computer forensics question - Microsoft Word - School Threat

[Tomato92]

Hello from Finland,

so our school received a threat recently. This threat was published on an intranet available to every computer in our school; the file was an MS Word file titled "VAROITUS.docx" = "warning". The metadata available on the file (properties) tells me when it was created, but not the computer. It also tells me how long it was worked on, only five minutes. So is there any additional metadata or anything that could reveal which computer it came from? Our computers wipe themselves of any changes after shut down, so the Y: intranet is used to save files. With good luck on our side and the origin known, the security cameras might reveal the perpetrator.

Our school is just north of Jokela, where there was a school shooting in 2007, we have plenty of students from there. Every class I heard of was deserted, with only one student in each. I strongly feel it was a sick "joke", so I want justice. The police is investigating it as an illegal threat, but all help was welcomed.

Threat message, de-capslocked and translated:

Warning!!! This is a warning of a future threat to this school! On Tuesday 27th of March there will happen an act, which will shock everyone at school that day! I apologize in advance for my actions, but I see no other options. I will do it at some point during the day, I won't specify further. Again, I'm sorry, but the world has been cruel to me. I will take it out on you. Burn in hell, all of you...

[MHD]

Investigate how the server logs access and file writes? I am somewhat certain any server with a bit of self respect logs FTP activity. Then investigate what IP submask wrote it or somesuch. I am no expert but that is where I would look.

[freakish777]

If you're talking about a shared drive when you say Y:

Then you can right click files and go to Properties. On the Details pain you can view Document Owner to correspond to an Active Directory account. If you don't have Active Directory set up properly and students logging into AD accounts to access your intranet... well, good luck figuring out who did it then, because it's going to be far more complicated than it has to be.

[Tomato92]

Thank you for your responses.

MHD, that's certainly a good suggestion. I'll talk with our principal asap. about requesting maintenance to access that if possible.

Freakish777, unfortunately the properties didn't reveal the computer the message originated from. I checked it first, of course. There were only two items in the properties that could've identified it, but, unfortunately, as I made a few test files on the drive these variables were the same no matter where I saved it. Yes, it's a big screw-up on the host's part. I always thought it would be an open and shut case if something like this happened. To the best of my knowledge it requires little effort to set it up that way.

[OmenPigeon]

.docx files are basically zip files with xml files inside. If you rename the document to varoitus.zip you'll be able to open it and read the data directly. One of the top level folders should be named, if memory serves, "docProps", or if not that then something similar. There should be two files in there, core.xml and app.xml. (There might also be a custom.xml, but it's rare.) If you pull those out of the archive and reformat them (Word doesn't put newlines in when it saves), you can read all the metadata out of those. Theoretically you should be able to read all these properties from inside Word too, but the document property menus are particularly awkwardly designed. There isn't a whole lot in those files that's personally identifying, and just about all the properties are optional, so don't get your hopes up too far. But if there is any metadata in the file, that's where it'll be.

[freakish777]

Freakish777, unfortunately the properties didn't reveal the computer the message originated from.

My point was that you shouldn't be trying to figure out which computer it came from, but rather which user account. If you're the IT person for your school's computer network, and you don't require people to log in to personalized accounts, you need to rethink how you're doing things.

Something that would help is what version of Windows we're talking about. At the network level, at the computer level, and at the level that the shared drive resides.

[Tomato92]

Maybe I wasn't clear, there are no user accounts. Everyone logs on with the same account and password for each computer. Yes I officially hate our IT guys, but on the other hand it would be unreliable and inconvenient to use user accounts. Hopefully the FTP has been or can be used to identify the computer.

I turned the file in to source using some online how-to thing, nothing revealed anything more than the properties already told me.

I'll contact police tomorrow, see if they know which computer it originated from. I lost track of what I was supposed to ask them, this morning, what with that other shooting incident up north. Thankfully no one as hurt this time. Thank you all, again.

[Sagekilla]

Maybe I wasn't clear, there are no user accounts. Everyone logs on with the same account and password for each computer. Yes I officially hate our IT guys, but on the other hand it would be unreliable and inconvenient to use user accounts. Hopefully the FTP has been or can be used to identify the computer.

I turned the file in to source using some online how-to thing, nothing revealed anything more than the properties already told me.

I'll contact police tomorrow, see if they know which computer it originated from. I lost track of what I was supposed to ask them, this morning, what with that other shooting incident up north. Thankfully no one as hurt this time. Thank you all, again.

Unreliable for who? And inconvenient for who? How is "having many user accounts" any more unreliable
than having a *single* user account? If anything, having ONE user account is unreliable because of the
incident that just happened.

And inconvenient? Seriously? People use user accounts all the time. I'd seriously doubt that any
student at your school has had no exposure to user accounts. The only "inconvenience" would be having
some sort of password retrieval or reset system, which you should be doing in the first place.

I'm sorry, but thinking that having one user account is "reliable" and "convenient" is an incredibly
irresponsible way to think of how to handle your computer systems. God forbid the kid actually followed
up on the threat and he managed to kill someone. If that actually happened you'd be royally screwed right
now compared to what would have been possible if you practiced proper user account management.

The sheer fact that this incident occurred should give you all the more reason to pressure your IT department
into changing the system. If not you, then get every other faculty member involved and have them collectively
pressure your IT guys.

[WarDaft]

If you have the kind of IT people who actually think its a good idea for everyone to share one user account, it might just actually be more reliable. That is, people might generally be able to use it, rather than it being in a permanent state of "my account isn't working!"

Note that this is not an excuse, merely an observation. Another observation is that the school needs better IT people.