Source: Juni_2026_Exams/Advance_Forensics/checklists/practical-exam-checklist.md

✅ Practical Exam Checklist

Use this checklist during the exam to stay organized and not miss anything.

Pre-Exam (Day Before)

• [ ] All tools installed and working
• [ ] Can open forensic image in FTK Imager
• [ ] Can load registry hives in Registry Explorer
• [ ] Can load $MFT in MFT Explorer
• [ ] DCode installed or online version accessible
• [ ] Printed: Registry artifact paths (from cheatsheet)
• [ ] Printed: Tool quick reference
• [ ] Got sleep! (Don't cram the night before)

Exam Setup (Start of Exam)

• [ ] Create working folder: D:\Evidence\ with subfolders:
• [ ] D:\Evidence\Registry\
• [ ] D:\Evidence\MFT\
• [ ] D:\Evidence\LNK\
• [ ] D:\Evidence\Files\
• [ ] D:\Evidence\Screenshots\

• [ ] Organize workspace
• [ ] FTK Imager window open
• [ ] Registry Explorer open (ready to load)
• [ ] MFT Explorer open (ready to load)
• [ ] DCode open or accessible
• [ ] Text editor for notes (Notepad++)

• [ ] Note start time
• [ ] Started: [Time]
• [ ] Estimated finish: [Time + exam duration]

Question Reading Phase (First 10-15 minutes)

• [ ] Read ALL questions without answering yet
• [ ] For each question, note:
• [ ] Question number
• [ ] What tool is needed?
• [ ] What artifact?
• [ ] Priority (easy vs hard?)

• [ ] Create priority list:
• [ ] Easy questions first (build confidence)
• [ ] Hard questions later (have more time to think)

Evidence Extraction Phase

FTK Imager Export

• [ ] Open forensic image in FTK Imager
• [ ] Export registry hives:
• [ ] Export SOFTWARE → D:\Evidence\Registry\SOFTWARE
• [ ] Export SYSTEM → D:\Evidence\Registry\SYSTEM
• [ ] Export SAM → D:\Evidence\Registry\SAM
• [ ] Export all NTUSER.DAT files (per user)
• [ ] D:\Evidence\Registry\NTUSER_DAT_[username]

• [ ] Export $MFT:
• [ ] Find $MFT at drive root
• [ ] Export → D:\Evidence\MFT\$MFT
• [ ] Verify: File size should be several MB

• [ ] Export LNK files:
• [ ] Navigate to Recent folder
• [ ] Export all .lnk files → D:\Evidence\LNK\

• [ ] Export suspicious files:
• [ ] Search for .exe in Temp
• [ ] Search for suspicious names
• [ ] Export → D:\Evidence\Files\

Verify Exports

• [ ] Check D:\Evidence\ folder
• [ ] Verify all files present
• [ ] Spot check: Can open registry hives in Registry Explorer

Question-by-Question Workflow

For Each Question:

Step 1: Understand the Question

• [ ] Read question 2-3 times carefully
• [ ] Underline key terms
• [ ] Note: What exactly is being asked?

Step 2: Identify Tool & Artifact

• [ ] What tool? (Registry → Registry Explorer, Deleted → MFT, etc.)
• [ ] What artifact? (SOFTWARE, SYSTEM, SAM, NTUSER.DAT, $MFT, .lnk)
• [ ] Check cheatsheet for exact path

Step 3: Extract Evidence

• [ ] Open appropriate tool
• [ ] Load correct hive/file
• [ ] Navigate to correct path
• [ ] Find the answer

Step 4: Verify & Convert if Needed

• [ ] Is this correct?
• [ ] Need to convert timestamps? → Use DCode
• [ ] Double-check reading

Step 5: Screenshot Evidence

• [ ] Take screenshot of tool showing answer
• [ ] Save to: D:\Evidence\Screenshots\Question_X.jpg
• [ ] Include: Full registry path / file location visible

Step 6: Write Answer

• [ ] Use answer template
• [ ] Answer to the question (first line)
• [ ] Evidence source
• [ ] Tool used
• [ ] Path/location
• [ ] Timestamp if relevant

Step 7: Review Before Moving On

• [ ] Does answer make sense?
• [ ] Did I answer what was asked?
• [ ] Evidence clearly stated?
• [ ] Ready to move to next question?

Specific Question Checklist

"Who owns this computer?" / "Registered owner?"

• [ ] Tool: Registry Explorer
• [ ] Hive: SOFTWARE
• [ ] Path: SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
• [ ] Answer: String value
• [ ] Screenshot taken?

"When was Windows installed?"

• [ ] Tool: Registry Explorer + DCode
• [ ] Hive: SOFTWARE
• [ ] Path: SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate
• [ ] Raw value: [note it]
• [ ] Converted with DCode? [UTC time]
• [ ] Screenshot of DCode result taken?

"What is the computer name?"

• [ ] Tool: Registry Explorer
• [ ] Hive: SYSTEM
• [ ] Path: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName
• [ ] Answer: String value
• [ ] Screenshot taken?

"When was system shut down?"

• [ ] Tool: Registry Explorer + DCode
• [ ] Hive: SYSTEM
• [ ] Path: SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime
• [ ] Raw hex value: [note it]
• [ ] Converted with DCode to FILETIME?
• [ ] Result: [UTC time]
• [ ] Screenshot taken?

"What files were recently opened?"

• [ ] Tool: Registry Explorer
• [ ] Hive: NTUSER.DAT
• [ ] Path: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
• [ ] List all entries?
• [ ] Screenshot taken?

"What programs were executed?"

• [ ] Tool: Registry Explorer
• [ ] Hive: NTUSER.DAT
• [ ] Path: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
• [ ] Values are ROT13 encoded?
• [ ] Need to decode first?
• [ ] Screenshot taken?

"Find deleted files"

• [ ] Tool: MFT Explorer
• [ ] File: $MFT
• [ ] Load $MFT in MFT Explorer
• [ ] Enable deleted filter
• [ ] Search for: [filename or *.exe]
• [ ] List findings:
• [ ] Filename
• [ ] Original path (from Full Path column)
• [ ] Created timestamp
• [ ] Status: DELETED
• [ ] Screenshots taken?

"Is there persistence?"

• [ ] Tool: Registry Explorer
• [ ] Check NTUSER.DAT Run keys:
• [ ] Path: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
• [ ] Any suspicious entries?
• [ ] Check SOFTWARE Run keys:
• [ ] Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• [ ] Any suspicious entries?
• [ ] Document findings:
• [ ] Registry path
• [ ] Suspicious entry name
• [ ] Points to: [executable path]
• [ ] Screenshots taken?

"Create timeline"

• [ ] Collect timestamps from:
• [ ] InstallDate (SOFTWARE)
• [ ] ShutdownTime (SYSTEM)
• [ ] UserAssist timestamps
• [ ] File creation times (MFT)
• [ ] File access times (LNK files)
• [ ] Convert all to UTC with DCode
• [ ] Sort chronologically
• [ ] Present in table format
• [ ] Screenshot of timeline taken?

During Exam - Time Management

5 Hours Total Exam

• [ ] 0:00-0:15 - Read all questions, plan
• [ ] 0:15-0:45 - Extract all evidence from forensic image
• [ ] 0:45-4:00 - Answer questions (3 hours for ~8-10 questions)
• [ ] 4:00-4:45 - Review all answers, verify evidence
• [ ] 4:45-5:00 - Final spot checks, submit

Per-Question Time Budget

If 10 questions in 3 hours:
└─ ~18 minutes per question (including finding + answering)
   ├─ 5 min: Find evidence
   ├─ 10 min: Write answer
   └─ 3 min: Review

If You Get Stuck

• [ ] Can't find evidence?
• [ ] Check cheatsheet for correct path
• [ ] Try search function (Ctrl+F)
• [ ] Open all 4 hives (SOFTWARE, SYSTEM, SAM, NTUSER.DAT)

• [ ] Timestamp won't convert?
• [ ] Check DCode format selection
• [ ] Try different format (Unix vs FILETIME)
• [ ] Copy value without leading 0x
• [ ] Use online converter as backup

• [ ] $MFT won't load?
• [ ] Check file size (should be >1 MB)
• [ ] Try re-exporting from FTK Imager
• [ ] Verify MFT Explorer is running correctly

• [ ] Time running out?
• [ ] Focus on Tier 1 registry questions
• [ ] Skip harder deleted file questions
• [ ] Answer what you can with full evidence

Final Review (Last 15 Minutes)

For each answer:

• [ ] Question clearly stated
• [ ] Answer is specific and concise
• [ ] Tool mentioned
• [ ] Path/location documented
• [ ] Evidence cited
• [ ] Timestamps converted and timezone included
• [ ] Screenshots attached
• [ ] No obvious typos
• [ ] Logic makes sense

Exam Submission

• [ ] All answers written
• [ ] Screenshots organized
• [ ] Notes organized
• [ ] Final review complete
• [ ] Ready to submit
• [ ] Submit at: [time]

Good luck! Remember:

• Focus on registry paths first (highest scoring)
• Always cite evidence
• Convert timestamps properly
• Take screenshots of everything
• Review before moving on

Last Updated: June 15, 2026