title: Incident Response & Computer Forensics, Third Edition
author:  Jason T. Luttgens 
description: <b>Jason T. Luttgens</b> is a former technical director of the security consulting firm Mandiant where he led dozens of global investigations involving industrial espionage, cardholder data theft, and other crimes. A veteran of NASA and the U.S. Air Force, he served in the Office of Special Investigations and at the Department of Defense's Computer Forensics Laboratory. <br /><b>Matthew Pepe</b> is a senior technical director and co-founder of Mandiant where he has led numerous investigations, serves as a subject matter expert, and developed the forensic capabilities that are in use today. A veteran of the U.S. Air Force, he served in the Office of Special Investigations' Computer Forensics Laboratory. <br /><b>Kevin Mandia</b> is senior vice president and chief operating officer of FireEye. He founded Mandiant in 2004 and served as the chief executive officer. While in the U.S. Air Force, Kevin served as a computer security officer at the Pentagon and as a special agent in the Air Force Office of Special Investigations.
zlib_text: Teaching Case
  Snowfall and a stolen laptop
  Mark-David J McLaughlin1,2, Sean Hansen3, W Alec Cram1, Janis L Gogan1
  1Bentley University, Waltham, USA;
  2Cisco Systems, San Jose, USA;
  3Rochester Institute of Technology, Rochester, USA
  Correspondence:
  W A Cram, Department of Information and Process Management, Bentley University, 175 Forest Street, Waltham, MA 02452,
  USA.
  Tel: +781 891 2811;
  Fax: +781 891 2949;
  E-mail: wcram@bentley.edu
  Abstract
  The E. Phillip Saunders College of Business (COB) Dean at Rochester Institute of Technology
  (RIT) discovers that his RIT-issued laptop has been stolen from his home. He notiﬁes Dave
  Ballard, a member of the College of Business IT staff. Ballard, still acutely aware of two recent
  incidents in which laptops containing thousands of Social Security numbers were stolen
  from the RIT campus, hopes the Dean’s laptop does not contain personally identiﬁable
  information. If so, the incident would need to be reported to the New York Attorney General’s
  Ofﬁce, an