1. Craig Tucker Case
Lauren Pixley, EnCE

2. The Suspect Only user account was named Craig
Found in SOFTWARE hive under ProfileList Subkey
s sent and received by Craig Tucker
Internet history and s showed Facebook account for Craig Tucker
Skype chat to and from Craig Tucker

3. Witnesses/Accomplices
Stan Marsh, Kyle Broflovski, and Kenny McCormick
Sent s to all three about coupons
Received attachments with coupons and guides on making coupons from all three
Subject: Free Coupons; 4chan Coupons, RE: College Paper! HELP; Re: Coupon Making; Awesome Coupons; Re: 4chan
Skype chat to Kenny McCormick about coupons
Skype chat logs from main.db file in AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\ LocalState\live#3acoupon-king_1 folder
s to Stan Marsh on underage pictures
Subject: Re: More Hot Pics

4. Crimes Committed/Crimes Planned
Accessed fraudulent retail coupons stored on his computer
Jump lists and link files show he accessed coupons in Documents/My Stuff folder and attachment folder
Has CP images stored on his computer
Pictures and movies in his recycle bin and in Windows/System32/system files folder
Potentially has CP and fraudulent coupons on other devices
Link files and jump lists show files in Coupons folder and underage pictures in Pictures folder on E: drive. The E: drive is a Kingston device Craig plugged in.
Sent and received fraudulent coupons
Subject: Free Coupons; 4chan Coupons, RE: College Paper! HELP; Re: Coupon Making; Awesome Coupons; Re: 4chan
Intentionally searched for and downloaded fraudulent coupons
Web history and web searches show Craig searched “coupons” and “how to make coupons”
Modified and produced fraudulent retail coupons
Recently-used.xbel file in AppData/Local folder shows Craig modified files using GIMP
Talked with others about using fraudulent retail coupons
Skype chat logs from main.db file in AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\ LocalState\live#3acoupon-king_1 folder

5. How it was Done/How it was Planned
Plugged in external drive to access potential CP and fraudulent coupons
SYSTEM, SOFTWARE, and NTUSER.DAT hives show Kingston device was plugged in
Used Windows 8 Mail App to send and receive fraudulent coupons
Subject: Free Coupons; 4chan Coupons, RE: College Paper! HELP; Re: Coupon Making; Awesome Coupons; Re: 4chan
Used Google Chrome to search for and download fraudulent coupons
Web history and web search shows searches for “coupons” and “how to make coupons”
Web downloads show zip and rar files downloaded from mediafire website
Used GIMP to modify and produce fraudulent retail coupons
Recently-used.xbel file in AppData/Local folder shows Craig modified files using GIMP
Used Skype chat to plan using fraudulent retail coupons
Skype chat logs from main.db file in AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\ LocalState\live#3acoupon-king_1 folder

6. Location
Chatted with Kenny McCormick about going to Walmart to use fraudulent retail coupons
Skype chat logs from main.db file in AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\ LocalState\live#3acoupon-king_1 folder
Went to Walmart to use fraudulent retail coupons
Craig was caught at Walmart
Sent with attachment bragging about using fraudulent coupon at Walmart
Subject: Re: Coupon Making

7. Dec 18 Dec 18 3 am 5 am 7 am 9 am 11 am 1 pm 3 pm 5 pm 7 pm Today
Downloaded zip file with fraudulent coupons
Dec 18, 7:50 pm
Downloaded rar file with fraudulent coupons
Dec 18, 8:05 pm
Downloaded zip file with fraudulent coupons
Received from Kenny with fraudulent coupons
Conducted search for coupons on 4chan website
Dec 18, 3:02 am
Dec 18, 12:02 pm
Dec 18, 8:05 pm
Dec 18
3 am
5 am
7 am
9 am
11 am
1 pm
3 pm
5 pm
7 pm
Dec 18
Today

8. Dec 20 Dec 21 1 pm 5 pm 9 pm 1 am 5 am 9 am 1 pm 5 pm Today
Conducted search on "make counterfeit coupons"
Dec 20, 9:11 pm
Accessed movie in Videos folder depicting child pornography
Accessed guide in Documents folder on how to make coupons
Dec 21, 7:42 pm
Dec 20, 9:26 pm
Chatted with Kenny McCormick about coupons
Chatted with Kenny McCormick about coupons
Dec 20, 11:59 pm
Dec 21, 11:31 am
Dec 20
1 pm
5 pm
9 pm
1 am
5 am
9 am
1 pm
5 pm
Dec 21
Today
Dec 20, 9:10 pm
Dec 21, 7:32 pm
Conducted search on "how to make coupons"
Accessed picture in Pictures folder depicting child pornography
Dec 20, 5:15 pm
Dec 21, 7:32 pm
Sent showing off his fraudulent coupons to Stan
Accessed another picture in Pictures folder depicting child pornography
Dec 20, 1:25 pm
Dec 21, 7:19 pm
Received from Stan with guides on making fraudulent coupons
Modified fraudulent coupon with GIMP

9. Recommendations
Look into Kyle Broflovski for also using and creating fraudulent coupons
Look into Kenny McCormick for also using and creating fraudulent coupons
Look into Stan Marsh for fraudulent coupons and child pornography