COI Report – Part IV
Page 168 of 425
531. On 12 July 2018, Benjamin prepared a consolidated report containing his findings from the forensic examination of the hard disk image of Workstation Band a summary of his earlier findings from the examination of the memory dump.
27.6 Sze Chun discovering on 5 July 2018 that SQL queries were
made to the SCM database since 27 June 2018, and informing
Ernest of the same
532. On the morning of 5 July 2018, Sze Chun decided to investigate further to determine the earliest date on which unusual queries had been run on the SCM database. He found that the earliest date on which such queries were made was
27 June 2018, and that there had been many such queries between 27 June and 4 July 2018.
533. On that morning, Sze Chun sent an email to Lum, Katherine, Kelvin, Loo, and Robin, containing details of the queries made from 27 June to 4 July 2018.
Sze Chun asked the recipients for advice on his findings and information regarding the whereabouts of VM 1. He also stated that he was “trying to
understand when Workstation B was confiscated”.
534. No one from the SMD was copied in Sze Chun’s 5 July 2018 email. However, on 5 or 6 July 2018, Ernest approached Sze Chun to discuss the events of 4 July 2018, and Sze Chun informed Ernest then of his findings, including the fact that the earliest query dated as far back as 27 June 2018. Ernest told Sze
Chun to hold onto findings, and something along-the-lines of “not to jump to
conclusions yet”. Sze Chun’s understanding was that the SMD was still investigating.
Sze Chun also did not have any other contact with Ernest after this meeting.
COI Report – Part IV Page 169 of 425 27.7 Series of measures taken on 6 and 7 July 2018 to secure the Share with your friends: |
