لخّصلي

The scenario as getting general information from website as following : The 2012 National Gallery DC scenario is a fictional case for digital forensics education and research. It involves two plots: one to steal valuable stamps from the gallery by Tracy, a supervisor, and her brother Pat, a police officer; and another to deface foreign artworks at the gallery by a group of Krasnovian sympathizers, led by Alex, a wealthy businessman, and Carry, a local contact. The scenario provides various digital evidence, such as disk images, mobile device images, network captures, and encrypted files, that can be analyzed by students or researchers using digital forensics techniques and tools. The scenario also includes persona descriptions, timelines, and teacher guides to help with the analysis and evaluation of the evidence.

The scenario spans approximately 10 days and encompasses two distinct yet intertwined story arcs. The first arc is about Tracy's plan to steal some rare stamps from the gallery, with the help of her brother Pat, who is a corrupt police officer. Tracy is a recently divorced mother who is struggling to pay for her daughter's private school and is in a custody battle with her ex-husband Joe. Pat is very devoted to his sister and niece and is willing to bend the law for them. Tracy and Pat communicate through various devices, such as Tracy's work computer, personal phone, and home computer, and Pat's police laptop and phone. They also exchange some physical evidence, such as a USB drive and a note. Tracy and Pat use some code words and encryption to hide their conspiracy, but they also leave some traces of their activities, such as web searches, emails, and text messages.

The second arc is about Alex's plot to deface some foreign artworks at the gallery, with the help of Carry, who is a Krasnovian supporter in the US. Alex is a wealthy businessman with Krasnovian ties who wants to embarrass America and damage public relations by vandalizing artworks that belong to Majavia, a rival country of Krasnovia. Carry is a young woman who has strong anti-American sentiments and is recruited by Alex through her father, who is also a Krasnovian sympathizer. Alex sends some 'tourists', who are actually Krasnovian militants, to Washington, DC to execute the plan. Carry is responsible for providing them with the tools and the access to the gallery. Carry contacts Tracy, who is an acquaintance of hers, and pretends to organize a flash mob at the gallery, in order to get some information about the security, schedules, events, and locations of the artworks. Carry pays Tracy some money for her help, which Tracy accepts due to her financial troubles. Carry uses various techniques, such as steganography, encryption, and spoofing, to conceal her communications with Alex and the 'tourists'. She also uses a tablet computer and a burner phone to avoid detection.

The scenario ends when Joe, Tracy's ex-husband, who installed a keylogger on her computer prior to the divorce, discovers the conspiracy to commit theft and reports her to the police. This leads to the seizure of Tracy's and Carry's devices and the revelation of the separate defacing plot. The police also request the network traffic logs from the gallery, which contain some evidence of Carry's activities. The scenario materials include disk images of hard drives and both logical and physical images of mobile devices. Network captures were performed using the SSLstrip tool, allowing for capture files to be available with and without encrypted SSL traffic. The scenario materials also include some teacher guides that provide some questions, answers, and hints for the analysis of the evidence.