A Game Called Murder - Chapter 2: Megasys (Part 2)
NB: Experimenting with different ways of structuring the titles for these
“Nothing here… what do you mean there’s nothing here?” Bob replied, striding toward Mikhail’s workstation. “Just what it sounds like. I opened the logfile from midnight last night and… nothing! Not even your typical network chatter.” “Let me see.” A worried look crosses Bob’s face as he almost jogs over to the computer. “Huh… you’re right. Not even ARP queries on the capture log. As far as I now there wasn’t any downtime last night until Scott called in. This is… not good.” Mikhail closes the file, taking a few screenshots of it just in case. He then opens the next entry in the folder. Again, nothing. Surprise turns to concern on his face, the unasked question hanging in the air between the two. Leaning in, Bob stops Mikhail from opening the next one in the series. “Hey, Mikhail. See anything with those last modified times?” Mikhail follows the technician’s finger. It seemed to be from a few minutes before. More interestingly, the time given was not uniform between the files. Someone or something had started modifying the entries in sequence, much the way that Mikhail would have looked at them. He scribbles a note on his pad of paper, documenting what he was seeing before his eyes. On a hunch he decides to reload the directory he was browsing and open several other Explorer windows, enabling him to look at each set of the log files from the affected time directly and simultaneously. Sure enough, as he had suspected the files’ last modified times were updating before his eyes except for one far down the listing - it still showed a time that matched when it was supposed to have been written. His hand trembling on the mouse, Mikhail double clicks on the file. ‘File is currently being edited by user Megasys\Scott.Mitchell. Would you like to open it in Read-Only mode?’ Mikhail and Bob share a look. “There has to be some explanation, right?” Bob asks after a few moments of silence. “Yep. There are a few different ways this could happen. Could be someone has stolen his password and we have an insider threat. Could be an account set up by our hacker made to look like Scott’s. Or…” Mikhail’s voice trails off, letting the third possibility go unsaid. “How can we tell?” “From here, we can’t. Need to be the domain admin or have the password to find out if that’s actually his. Alternatively, we could go ask Scott himself, right now.”