CorporateSecrets Lab

A Windows forensics challenge prepared by Champlain College Digital Forensics Association for their yearly CTF. Windows Image Forensics Case created by AccessData® FTK® Imager 4.2.1.4 Acquired using: ADI4.2.1.4 -------------------------------------------------------------- Information for F:\DFA_Windows\DFA_SP2020_Windows: Physical Evidentiary Item (Source) Information: [Device Info] Source Type: Physical [Drive Geometry] Cylinders: 6,527 Heads: 255 Sectors per Track: 63 Bytes per Sector: 512 Sector Count: 104,857,600 [Physical Drive Information] Drive Interface Type: lsilogic [Image] Image Type: VMWare Virtual Disk Source data size: 51200 MB Sector count: 104857600 Image Information: Segment list: F:\DFA_Windows\DFA_SP2020_Windows.E01 F:\DFA_Windows\DFA_SP2020_Windows.E02 F:\DFA_Windows\DFA_SP2020_Windows.E03 F:\DFA_Windows\DFA_SP2020_Windows.E04 F:\DFA_Windows\DFA_SP2020_Windows.E05 F:\DFA_Windows\DFA_SP2020_Windows.E06 F:\DFA_Windows\DFA_SP2020_Windows.E07 F:\DFA_Windows\DFA_SP2020_Windows.E08 F:\DFA_Windows\DFA_SP2020_Windows.E09 Your objective as a soc analyst is...