IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/checklists/evidence-answer-format.md

📋 Evidence Answer Format Guide

How to Write Forensic Exam Answers

Follow this format for every answer to get full marks.

Answer Structure

1. Direct Answer (1st line)

[DIRECTLY ANSWER THE QUESTION]

Examples:
"The registered owner is John Doe."
"Windows was installed on December 31, 2020."
"NO - there is no evidence of persistence."
"YES - malware was found at C:\Temp\malware.exe"

2. Evidence Source

[Where did you find this?]

Format: "Found in [HIVE/FILE] at [PATH]"

Examples:
"Found in SOFTWARE hive at RegisteredOwner"
"Found in $MFT (deleted file entry 12345)"
"Found in NTUSER.DAT RecentDocs"
"Found in Run registry key"

3. Tool Used

[What tool did you use?]

Format: "Tool: [TOOL NAME]"

Examples:
"Tool: Registry Explorer"
"Tool: MFT Explorer"
"Tool: DCode"
"Tool: FTK Imager"

4. Timestamp (if applicable)

[When did this happen? (ALWAYS UTC)]

Format: "[DATE] [TIME] UTC"

Examples:
"2021-08-10 14:30:00 UTC"
"2020-12-31 12:00:00 UTC (13:00 CET)"
"2021-08-10 18:45:32 UTC"

5. Raw vs. Converted Data

[If conversion needed, show both]

Format:
Raw value: [hex/epoch]
Converted: [readable date/time]

Examples:
Raw: 1577836800
Converted: 2020-12-31 12:00:00 UTC

Raw: 01D123456789ABCD
Converted: 2021-08-10 14:30:45 UTC

Format Example 1: Simple Registry Value

Question: "Who is the registered owner?"

Answer:
The registered owner is John Doe.

Evidence:
- Hive: SOFTWARE
- Path: Microsoft\Windows NT\CurrentVersion\RegisteredOwner
- Value: "John Doe"
- Tool: Registry Explorer
- Confidence: High

Format Example 2: Timestamp Conversion

Question: "When was Windows installed?"

Answer:
Windows was installed on December 31, 2020 at 12:00 UTC.

Evidence:
- Hive: SOFTWARE
- Path: Microsoft\Windows NT\CurrentVersion\InstallDate
- Raw value: 1577836800 (Unix timestamp)
- Converted: 2020-12-31 12:00:00 UTC
- Tool: Registry Explorer + DCode
- Local time: 13:00 CET (UTC+1)
- Confidence: High

Format Example 3: Multiple Items

Question: "Provide system identification information"

Answer:

1. Registered Owner: John Doe
   - Source: SOFTWARE\RegisteredOwner
   
2. Computer Name: WORKSTATION-01
   - Source: SYSTEM\ComputerName
   
3. Installation Date: December 31, 2020 12:00 UTC
   - Source: SOFTWARE\InstallDate (converted from 1577836800)
   
4. Windows Version: Windows 10 Pro
   - Source: SOFTWARE\ProductName

Tool used: Registry Explorer
Confidence: High

Format Example 4: Deleted Files

Question: "Find all deleted executables"

Answer:
Found 2 deleted executable files:

1. malware.exe
   - Original Path: C:\Users\John\AppData\Local\Temp\
   - File Size: 245,120 bytes
   - Created: 2021-08-09 14:30:00 UTC
   - Modified: 2021-08-09 14:42:00 UTC
   - Status: DELETED
   - Source: MFT (entry 12345)

2. backdoor.exe
   - Original Path: C:\Windows\Temp\
   - File Size: 187,392 bytes
   - Created: 2021-08-08 10:00:00 UTC
   - Status: DELETED
   - Source: MFT (entry 23456)

Tool: MFT Explorer
Confidence: High
Notes: Both files in temporary locations (suspicious)

Format Example 5: Persistence

Question: "Is there evidence of malware persistence?"

Answer:
YES - Evidence of persistence found.

Persistence Mechanism:
- Registry Location: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
- Entry Name: "Windows Update"
- Executable Path: C:\Windows\Temp\malware.exe
- Impact: Program runs automatically when user logs in

Verification:
- File exists: YES (confirmed in MFT)
- File location: SUSPICIOUS (Temp folder)
- Name: SUSPICIOUS (mimics Windows Update)
- Timestamp: Created 2021-08-09 14:30 UTC

Tool: Registry Explorer + MFT Explorer
Confidence: High

Format Example 6: Timeline

Question: "Create a timeline of events"

Answer:

| Time | Event | Source | Details |
|------|-------|--------|---------|
| 2020-12-31 12:00 UTC | Windows Installed | SOFTWARE\InstallDate | System setup |
| 2021-08-05 15:30 UTC | Malware Downloaded | MFT Created timestamp | File: malware.exe |
| 2021-08-09 14:30 UTC | Malware Executed | UserAssist registry | Program run detected |
| 2021-08-10 08:15 UTC | Backdoor Accessed | LNK file access time | File opened |
| 2021-08-10 14:30 UTC | Persistence Set | Registry Run key | Auto-start configured |
| 2021-08-10 18:30 UTC | User Last Active | RecentDocs | Documents accessed |
| 2021-08-10 18:45 UTC | System Shutdown | ShutdownTime registry | Powered down |

Tool: Registry Explorer, MFT Explorer, DCode
Confidence: Medium-High
Notes: Some timestamps converted with DCode

What NOT to Do

❌ Don't: Answer without evidence

Wrong: "The file was deleted"
Right: "The file malware.exe was deleted (MFT entry 12345 at C:\Temp\)"

❌ Don't: Forget timezone

Wrong: "At 14:30"
Right: "At 14:30 UTC" or "At 14:30 UTC (16:30 CET)"

❌ Don't: Show raw timestamp without conversion

Wrong: "InstallDate = 1577836800"
Right: "InstallDate = 1577836800 (converted: 2020-12-31 12:00 UTC)"

❌ Don't: Forget the tool

Wrong: "Found RegisteredOwner value"
Right: "Found RegisteredOwner value in SOFTWARE hive using Registry Explorer"

❌ Don't: Use unclear paths

Wrong: "In the registry"
Right: "In SOFTWARE hive at Microsoft\Windows NT\CurrentVersion\RegisteredOwner"

❌ Don't: Mix tools without mentioning

Wrong: "The file was malware.exe located at C:\Temp"
Right: "MFT Explorer shows malware.exe deleted from C:\Temp (entry 12345)"

Quick Checklist for Each Answer

Before submitting:

Scoring Rubric

Full Points (100%)

High Points (80-90%)

Medium Points (50-80%)

Low Points (<50%)

Final Review Checklist

Before each answer, verify:

  1. Comprehension: Did I understand the question?
  1. Accuracy: Is my answer correct?
  1. Completeness: Have I included everything?
  1. Clarity: Is it understandable?
  1. Confidence: Am I confident?

Last Updated: June 15, 2026