Digital Forensics Quiz

When did Alex Jensen most likely log into his Windows account?

• 20:48

• 21:02

• 18:30
• 20:55

Which artifact provides the strongest direct evidence that Alex knew the location of the confidential file `final_design.fzz`?

• The Prefetch file for `NOTEPAD.EXE`

• The `OpenPidlMRU` registry value

• The browser history showing `dropsend.com`

• The MFT entry for `temp_export.png`

What is the most likely sequence of program execution based on the evidence?

• Chrome → Notepad → PowerShell → Cmd

• PowerShell → Notepad → Cmd → Chrome

• Cmd → PowerShell → Chrome → Notepad

• Notepad → Chrome → PowerShell → Cmd

The command `cmd /c del C:\Users\AJensen\Downloads\temp_export.png` suggests what?

• Alex was trying to open the file.

• Alex was attempting to hide his actions by avoiding the Recycle Bin.

• Alex was installing a new program.

• The file was deleted by a system process.

What is the significance of the browser history entries for `dropsend.com`?

• It proves Alex visited a social media site.

• It suggests the use of a web-based service to send a file.

• It shows Alex was researching competitors.

• It indicates the browser was infected with malware.

Which two artifacts, when combined, provide the strongest evidence of data exfiltration?

• ProfileList LastWriteTime and Notepad Prefetch

• OpenPidlMRU and MFT entry for `temp_export.png`

• RunMRU (delete command) and Browser History (Dropsend visit)

• PowerShell Prefetch and Chrome Prefetch

If you could recover only one deleted file to strengthen the case, which would it be?

• `final_design.fzz`

• `temp_export.png`

• A Prefetch file

• A random system DLL

The `LastWriteTime` on the `OpenPidlMRU` registry key (20:50) is most consistent with which other event?

• The user login at 18:30

• The creation of `temp_export.png` at 20:48

• The execution of Chrome at 20:58

• The file deletion at 20:55