Timeline Analysis of Desktop Property # 0214 207268 HDD Image Z6E8M349.E01 (Device 1) Important Identifiers: User: Michael Thomas Username: BOP19012 SID: S-1-5-21-1823249720-3210992811-1527010081-1102 SID: Microsoft Security Identifier Date Time Action 8/10/2019 0:36:54 User BOP19012 Successfully Logged onto the System 8/10/2019 0:38:36 User launches GroupWise (grpwise.exe) 8/10/2019 0:39:31 User saves/downloads document named "SHU 30 CHECK SHEET (CONDENSED)_1.docx" to location "CAUsers \bop19012 \ Documents \GroupWise 8/10/2019 0:39:31 The "SHU 30 CHECK SHEET (CONDENSED)_1.docx" Word Document is also opened at this time. 8/10/2019 0:40:10 The GroupWise program crashes 8/10/2019 0:40:14 The GroupWise program reloads 8/10/2019 0:43:00 Last Printed timestamp indicates "SHU 30 CHECK SHEET (CONDENSED)_1.docx" was printed 8/10/2019 0:44:19 User saves/downloads document named "SHU Rules Metropolitan Correctional Center New York.docx" to location "CAUsers\bop19012\DesktopV 8/10/2019 0:44:19 The "SHU Rules Metropolitan Correctional Center New York.docx" Word Document is also opened at this time 8/10/2019 0:44:53 User opens document named "SHU ORDERLY REQUEST 42214.rtf" from location "C: \Users \bop19012 DesktopV 8/10/2019 0:45:58 User launches Calculator (calc.exe) 8/10/2019 0:48:20 User opens document named "1- SHU LOCATOR 2019(HARDCOPY).docx" from network location "\\NYMC_GRPS_SERVER\GRPS\GROUPS\SHAREDOC\SHU PAPERWOF 8/10/2019 0:49:11 Execution of splwow64.exe by user BOP19012 indicates something was printed from the system 8/10/2019 0:50:50 User launches Calculator (calc.exe) 8/10/2019 0:53:20 User continues to access document named "1- SHU LOCATOR 2019(HARDCOPY).docx" from network location 8/10/2019 0:53:31 User launches Internet Explorer (iexplorer.exe) 8/10/2019 0:53:35 User is navigated in IE to "iellwelcome.microsoft.com/" 8/10/2019 0:53:37 User is navigated in IE to "http://sallyport.bop.gov/" -- In