Directions: Locate and export the Registry files from Justine’s computer. Answer the analysis questions using AND provide documentation of each artifact location. Answers MUST include both the findings AND the path to the evidence artifact (for example, the exact registry key path).
Provide answers and artifact path to the following questions:
Locate Justine’s unique security identifier:
What is Justine’s full SID?
Answer:
Path:
Which part of this ID is the Relative Identifier (RID)?
Answer:
Path:
Locate the time zone of this computer at the time the forensic image was made:
What is the LOCAL time zone?
Answer:
Path:
What is the time bias from the LOCAL time zone of this computer to UTC.
Answer:
Path:
Answer the following questions using the SOFTWARE and SYSTEM files:
Who is the registered owner of this system?
Answer:
Path:
What operating system is installed on the computer?
Answer:
Path:
When was the operating system installed?
Answer:
Path:
Document the following about Justine’s user account using the SAM file:
When was Justine last logged on to this machine?
Answer:
Path:
How many times did someone try and fail to logon to Justine’s account?
Answer:
Path:
Does Justine’s account require a password? How do you know?
Answer:
Path:
How many USB devices have been plugged into this computer?
Answer:
Path:
What was the last wireless network this computer connected to?
Answer:
Path:
Justine maintained and Gmail account and connected it to Outlook. Document the email address and show its connection to Outlook. Use the NTUSER file for this question.
Answer:
Path:
Identify Justine’s two most recently accessed documents. Remember that “documents” can be any file type.
Answer:
Path:
