Autopsy

• What is the file extension of the Autopsy files?

.aut

• What is the disk image name of the "e01" format?

EnCase

• Expand the "Data Sources" option; what is the number of available sources?

4

• What is the number of the detected "Removed" files?

10

• What is the filename found under the "Interesting Files" section?

googledrivesync.exe

• What is the full name of the operating system version?

Windows 7 Ultimate Service Pack 1

• What percentage of the drive are documents? Include the % in your answer.

40.8%

• Generate an HTML report as shown in the task and view the "Case Summary" section.

What is the job number of the "Interesting Files Identifier" module? 

10

• What is the name of an Installed Program with the version number of 6.2.0.2962?

Eraser

• A user has a Password Hint. What is the value?

IAMAN

• Numerous SECRET files were accessed from a network drive. What was the IP address?

10.11.11.128

• What web search term has the most entries?

information leakage cases

• What was the web search conducted on 3/25/2015 21:46:44?

anti-forensic tool

• What MD5 hash value of the binary is listed as an Interesting File?

fe18b02e890f7a789c576be8abccdc99

• What self-assuring message did the 'Informant' write for himself on a Sticky Note? (no spaces)

Tomorrow...Everything will be OK...

• Using the Timeline, how many results were there on 2015-01-12?

46

• The majority of file events occurred on what date? (MONTH DD, YYYY)

March 25, 2015