The Silk Road Takedown (2013) — First Response Masterclass

FBI agents arrested Ross Ulbricht in a public library. The critical move: an agent grabbed his laptop while still on to prevent TrueCrypt encryption from locking the drive.

## Background

FBI agents arrested Ross Ulbricht in a public library. The critical move: an agent grabbed his laptop while still on to prevent TrueCrypt encryption from locking the drive.

## Learning Objective
Master the physical and digital triage of a live crime scene.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: The Silk Road Takedown (2013) — First Response Masterclass
- Year: 2013
- Domain: Cyber Forensics
- Difficulty: Advanced

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-silk-road-takedown

## Investigation Questions

1. Why was seizing the laptop while powered on critical to the investigation?
2. List the order of volatility and explain its relevance to this case.
3. What encryption technologies were at risk if the laptop was shut down?
4. How did the FBI use physical surveillance alongside digital forensic principles?
5. What modern forensic tools would you use to image RAM on a live MacBook?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Rule #1: Do NOT turn off the computer. Rule #2: Photograph the screen. Rule #3: Disconnect network, but keep power.

## Forensic Takeaway
The 'order of volatility' (RAM > Disk > Backup). If they had turned it off, LUKS/FileVault encryption would have made evidence inaccessible.