Final Exercise

Use the provided file: “SuspectActivity.zip”
SHA1: a8f601018fdef6d8954026e7431963416021a107

1. You, being a forensic examiner, received for examination an archive file named “SuspectActivity.zip”
2. According to the police report the “Recent Items” folder was extracted from the suspect computer.
   • The full path of the extracted folder is: C:\Users\UserName\AppData\Roaming\Microsoft\Windows\Recent
3. 3. Your task is to analyse the content of the folder and document your findings.