John Doe was accused of doing illegal activities. A disk image of his laptop was taken. Your task is to analyze the image and understand what happened under the hood.
What is the MD5 hash value of the suspect disk?
What phrase did the suspect search for on 2021-04-29 18:17:38 UTC? (three words, two spaces in between)
What is the IPv4 address of the FTP server the suspect connected to?
What date and time was a password list deleted in UTC? (YYYY-MM-DD HH:MM:SS UTC)
How many times was Tor Browser ran on the suspect's computer? (number only)
What is the suspect's email address?
What is the FQDN did the suspect port scan?
What country was picture "20210429_152043.jpg" allegedly taken in?
What is the parent folder name picture "20210429_151535.jpg" was in before the suspect copy it to "contact" folder on his desktop?
A Windows password hashes for an account are below. What is the user's password?
What is the user "John Doe's" Windows login password?