IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/checklists/tools-cheatsheet.md

⚡ Tools Cheatsheet - Quick Reference

Print this and keep at desk during exam

FTK Imager Quick Commands

Launch


### Open Forensic Image

File → Add Evidence Item → Image File Select: .001, .E01, or .dd file Wait: Image loads


### Export Registry

Navigate: C:\Windows\System32\config\ Right-click: SOFTWARE/SYSTEM/SAM Export → Choose destination Result: D:\Evidence\Registry\[HIVE]\n```

Export $MFT

Find: $MFT at C: (root)
Right-click → Export
Destination: D:\Evidence\MFT\

Export LNK Files

Navigate: C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent
Select: All .lnk files (Ctrl+A)
Right-click → Export
Destination: D:\Evidence\LNK\

Search for Files

Ctrl+F (or Edit → Search)
Enter: Filename (e.g., malware.exe)
Results: All matches with paths

Registry Explorer Quick Commands

Launch

AccessData → Registry Explorer
Or direct executable

Open Hive

File → Open Hive (Ctrl+O)
Select: SOFTWARE/SYSTEM/SAM/NTUSER.DAT
Load: Hive opens

Search in Hive

Ctrl+F
Enter: Search term (e.g., RegisteredOwner)
Result: Matching key/value locations
Left pane: Click folder icons to expand
Navigate: Like folder tree
Right pane: Shows values for selected key

Read Value

Left pane: Select key
Right pane: Shows values
Double-click: Copy or edit (view only)

Common Paths (Use Ctrl+F)

RegisteredOwner → Find directly
ShutdownTime → Find directly
RecentDocs → Search for RecentDocs
UserAssist → Search for UserAssist
Run → Search for Run

MFT Explorer Quick Commands

Launch

AccessData ExplorerSuite → MFT Explorer
Or direct executable

Load $MFT

File → Open (Ctrl+O)
Select: $MFT file (exported from FTK)
Load: MFT loads (can take 30+ seconds)
Status: "Ready" when complete

Show Deleted Files

View → Filter
Check: "Show deleted entries"
Uncheck: "Show allocated entries"
Result: Only deleted files visible

Search in MFT

Ctrl+F
Enter: Filename (e.g., malware.exe)
Include: Check "Deleted" if looking for deleted
Results: All matching entries

Find File Location

Search results show: Full Path column
If parent deleted: Look at Parent Entry → Search that
Result: Original directory location

Sort by Date

Click: Column header (Created, Modified, Accessed, B)
Result: Files sorted by that timestamp

DCode Quick Commands

Launch

C:\Program Files\AccessData\DCode\DCode.exe
Or: Online version

Convert Timestamp

1. Left side: Select format
   - Unix Timestamp
   - Windows FILETIME
   - DOS Timestamp
   - Other

2. Paste: Value into input field

3. Read: Output shows converted time
   - UTC time
   - Local time
   - Decimal equivalent

Input Formats

Unix:      1628610645 (decimal, no 0x)
FILETIME:  01D12345ABCDEF (hex, remove 0x)
DOS:       5208 B30A (hex format)

Output

Shows: UTC and Local time automatically
Timezone: Set in settings for local
Copy: Click to copy result

Tools Reference Table

Need Tool Command Input
Extract evidence FTK Imager File → Export Forensic image
Analyze registry Registry Explorer Ctrl+O .hive files
Find deleted files MFT Explorer Ctrl+O $MFT file
Convert timestamps DCode Paste value Hex/Unix/DOS
Analyze shortcuts LNK Parser (LECmd) Command-line .lnk files

Keyboard Shortcuts

Registry Explorer

Ctrl+O    → Open hive
Ctrl+F    → Search
Ctrl+C    → Copy value
Ctrl+N    → New window
F5        → Refresh

FTK Imager

Ctrl+E    → Export file
Ctrl+F    → Search
F5        → Refresh

MFT Explorer

Ctrl+O    → Open $MFT
Ctrl+F    → Search
Ctrl+C    → Copy entry
Sort: Click column header

File Locations Reference

Registry:
  SOFTWARE:    C:\Windows\System32\config\SOFTWARE
  SYSTEM:      C:\Windows\System32\config\SYSTEM
  SAM:         C:\Windows\System32\config\SAM

User files:
  NTUSER.DAT:  C:\Users\[User]\NTUSER.DAT
  Recent:      C:\Users\[User]\AppData\Roaming\Microsoft\Windows\Recent\
  Temp:        C:\Users\[User]\AppData\Local\Temp\

$MFT:
  Location:    C:\ (root, system file, usually hidden)

Prefetch:
  Location:    C:\Windows\Prefetch\

Common Paths in Registry

RegisteredOwner:
  Software\Microsoft\Windows NT\CurrentVersion

InstallDate:
  Software\Microsoft\Windows NT\CurrentVersion

ComputerName:
  System\CurrentControlSet\Control\ComputerName\ComputerName

ShutdownTime:
  System\CurrentControlSet\Control\Windows

RecentDocs:
  Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

UserAssist:
  Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Run:
  Software\Microsoft\Windows\CurrentVersion\Run

Troubleshooting

FTK Imager

Image won't load?
  → Check file extension (.001, .E01)
  → Select first part only
  → Check file permissions

Can't find file?
  → Use Ctrl+F search
  → Check exact path
  → File might be deleted (in Unallocated)

Registry Explorer

Hive won't open?
  → Verify it's a registry hive (not .txt)
  → Try from different location
  → Check export integrity

Path not found?
  → Use Ctrl+F to search
  → Check spelling
  → Hive might be from different Windows version

DCode

Conversion fails?
  → Check input format selection
  → Remove leading 0x from hex
  → Verify value is correct
  → Try online version as backup

MFT Explorer

$MFT won't load?
  → Check file size (should be several MB)
  → Verify it's actual $MFT, not corrupted
  → Try re-exporting from FTK

Deleted filter not working?
  → Use View → Filter menu
  → Uncheck "Show allocated"
  → Or search with deleted flag

Workflow Diagram

START: Have forensic image

    ↓
FTK Imager: Extract evidence
├─ Export registry hives
├─ Export $MFT
├─ Export .lnk files
└─ Export suspicious files

    ↓
Registry Explorer: Analyze hives
├─ Open SOFTWARE
├─ Open SYSTEM
├─ Open SAM
├─ Open NTUSER.DAT
└─ Search for answers

    ↓
MFT Explorer: Find deleted files
├─ Open $MFT
├─ Filter deleted
├─ Search files
└─ Document findings

    ↓
DCode: Convert timestamps
├─ Copy hex/unix value
├─ Select format
├─ Paste and convert
└─ Record result

    ↓
Write Answer
├─ Question restated
├─ Evidence cited
├─ Tool mentioned
├─ Path documented
└─ Submit

Pre-Exam Tool Check

Last Updated: June 15, 2026