Protected: Windows Artifacts

0 of 22 lessons complete (0%)
Exit Course
Back to lesson

Final Exercise Quiz

  1. 1. How many shortcut files did you find within the folder “Recent”(from the archive named “SuspectActivity.zip”)?

    [Points: 1]

  2. 2. What was in the “Recent” folder besides the shortcut files? Select all that apply

    [Points: 1]

  3. 3. Which shortcut file has a modification date and time of March 26 at 11:15 PM?

    [Points: 1]

  4. 4. What is the Automatic Destination folder?

    [Points: 1]

  5. 5. What is the Custom Destination folder?

    [Points: 1]

  6. 6. What files have been accessed from the removable media connected to the computer? Select all that apply.

    [Points: 1]

  7. 7. What are the removable media’s drive letters you found?

    [Points: 1]

  8. 8. The “Hidden.lnk” file points to a file and not a directory.

    [Points: 1]

  9. 9. What is the original path for the “Hidden.lnk”?

    [Points: 1]

  10. 10. What is the size of the target file “CreditCardsNumbers.txt”?

    [Points: 1]

  11. 11. Which MAC addresses did you find? Select all that apply.

    [Points: 1]

  12. 12. What is the Volume Label(s) of drive E:?

    [Points: 1]

  13. 13. Were any machine IDs associated with the shortcut files? If yes, what were they? Select all that apply.

    [Points: 1]

  14. 14. Have you found any traces of VPN software being executed on the computer? If yes,what were the applications/

    [Points: 1]

  15. 15. If you found traces of a VPN software being used, which file(s) did you find it in? Select all that apply.

    [Points: 1]

  16. 16. Have you found any traces of any remote desktop application being executed on the computer? If yes what were they?

    [Points: 1]

  17. 17. If you found traces of a remote desktop application being used, which file(s) did you find it in? Select all that apply.

    [Points: 1]

  18. 18. What was the application ID for the remote desktop application?

    [Points: 1]
Scroll to Top