AfricanFalls

Category : Digital Forensics

Windows FTKImager Disk

880 Players

4.4 (77)

Medium

What is the MD5 hash value of the suspect disk?

Weight : 25 | Solved : 577

What phrase did the suspect search for on 2021-04-29 18:17:38 UTC? (three words, two spaces in between)

Weight : 25 | Solved : 461

What is the IPv4 address of the FTP server the suspect connected to?

Weight : 25 | Solved : 453

What date and time was a password list deleted in UTC? (YYYY-MM-DD HH:MM:SS UTC)

Weight : 25 | Solved : 435

How many times was Tor Browser ran on the suspect's computer? (number only)

Weight : 50 | Solved : 436

What is the suspect's email address?

Weight : 50 | Solved : 412

What is the FQDN did the suspect port scan?

Weight : 50 | Solved : 391

What country was picture "20210429_152043.jpg" allegedly taken in?

Weight : 50 | Solved : 420

What is the parent folder name picture "20210429_151535.jpg" was in before the suspect copy it to "contact" folder on his desktop?

Weight : 75 | Solved : 382

Q10

A Windows password hashes for an account are below. What is the user's password? Anon:1001:aad3b435b51404eeaad3b435b51404ee:3DE1A36F6DDB8E036DFD75E8E20C4AF4:::

Weight : 75 | Solved : 347

Q11

What is the user "John Doe's" Windows login password?

Weight : 75 | Solved : 324

Instructions:

Unzip the challenge (pass: cyberdefenders.org)

John Doe was accused of doing illegal activities. A disk image of his laptop was taken. Your task is to analyze the image and understand what happened under the hood.