The Shoe Lane ATM Heist (2010) — Testing a Hypothesis

ATM machines dispensing cash without card insertion. Investigators hypothesized an internal banking employee and tested this by correlating transaction timestamps with employee shift-login logs.

## Background

ATM machines dispensing cash without card insertion. Investigators hypothesized an internal banking employee and tested this by correlating transaction timestamps with employee shift-login logs.

## Learning Objective
Apply the scientific method (hypothesis, testing, validation) to digital forensic investigations.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The Shoe Lane ATM Heist (2010) — Testing a Hypothesis
- Year: 2010
- Domain: Cyber Forensics
- Difficulty: Intermediate

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-shoe-lane-atm-heist

## Investigation Questions

1. Formulate a hypothesis for how the ATM dispensed cash without card insertion.
2. What SQL joins would you use to correlate transaction records with staff shifts?
3. How did the investigators prove it was an insider rather than an external attack?
4. What is the null hypothesis in this investigation?
5. Design a query to find all transactions without preceding card_auth entries.

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Always have a null hypothesis. If you assume guilt before examining the data, you will bias your forensic analysis.

## Forensic Takeaway
Forensics is not just finding files; it's forming a testable hypothesis and methodically proving it through log correlation.