Protected: Windows Artifacts

0 of 22 lessons complete (0%)

Final Exercise

Final Exercise

Use the provided file: “SuspectActivity.zip
SHA1: a8f601018fdef6d8954026e7431963416021a107
  1. You, being a forensic examiner, received for examination an archive file named “SuspectActivity.zip”
  2. According to the police report the “Recent Items” folder was extracted from the suspect computer.
    • The full path of the extracted folder is: C:\Users\UserName\AppData\Roaming\Microsoft\Windows\Recent
  3. 3. Your task is to analyse the content of the folder and document your findings.

Scroll to Top
Our office will be closed this Monday, February 16, in observance of Presidents Day.
We will resume normal operations on Tuesday.
Washington Logo Holiday