Source: Juni_2026_Exams/Advance_Forensics/HANDOUT.md

📚 HANDOUT - Forensics Exam Preparation

Welcome!

This is a practical preparation repository for the Advanced Forensics and Malware Analysis lab exam. Its priorities are now derived from the uploaded 2026 lectures and the verified 2025 practical exam.

📁 What's Inside

Folder	Purpose	What to Do
`reference_pdfs/`	Source lectures and exam PDFs	Keep source files unchanged
`lectures/`	Optional additional lecture material	Add only material not already in `reference_pdfs/`
`exams/`	Additional exam files/images	Keep year-specific material organized
`notes/`	Learning materials	Read these to understand tools & artifacts
`solutions/`	Example answers	Study to understand answer format
`stories/`	Project updates	Track progress of exam prep
`checklists/`	Quick references	Use during study + exam

🎯 Current Status

Completed:

seven lecture PDFs inventoried and analyzed
2025 exam questions and answers verified
source-backed priorities and malware-analysis tool guide
47 lecture exercises converted into a step-by-step workbook
verified 2025 exam walkthrough
practical malware-analysis exam checklist

Still needed:

hands-on completion notes from the university VM
screenshots for each lecture exercise
any newer exam papers or lecturer clarifications

📋 How This Repo Works

Read notes/00-focus-points.md.
Keep notes/14-exam-day-open-notes-reference.md available during practice

and the open-notes exam.

Learn the workflow in notes/01-tooling-overview.md.
Complete notes/13-lecture-exercises-step-by-step.md in order; it contains

both the explanations and exact commands.

Use notes/16-exam-terms-and-tools-glossary.md for definitions, recognition

evidence, tool selection, and answer language.

Reproduce solutions/exam-2025-verified-walkthrough.md.
Use checklists/malware-analysis-exam-checklist.md during timed practice.

📤 Where to Upload Files

Source lectures

Place shared source PDFs in reference_pdfs/. Do not edit or rename existing sources without updating reference_pdfs/README.md.

Previous Exams

exams/
├── Exam_June_2024_Questions.pdf
├── Exam_June_2024_Image.001
├── Exam_June_2024_Solution.md
└── etc.

The actual 2025 malware-analysis exam and answer PDFs are in reference_pdfs/. The old DOCX metadata under exams/Computer_Forensics_2025 is historical and is not the source used for the verified walkthrough.

Screenshots & Evidence

lectures/screenshots/
exams/sample-answers/

🔄 How to Update Notes

When adding or completing an exercise:

Cite source PDF and page.
Record sample and VM snapshot.
Document exact tool/version, command/filter, and steps.
Separate observed result from interpretation.
Add screenshot filenames, but do not commit sensitive or huge captures.
Update notes/13-lecture-exercises-step-by-step.md.
Update the status table below.

Area	Owner	Status	Evidence/notes
Lecture 1 hashes	Unassigned	Guide ready	VM execution pending
Lectures 2-3 PE/memory	Unassigned	Guide ready	VM execution pending
Lecture 4 static analysis	Unassigned	Guide ready	VM execution pending
Lectures 5-6 dynamic analysis	Unassigned	Guide ready	VM execution pending
Lecture 7 persistence	Unassigned	Guide ready	VM execution pending
Lecture 8 networking	Unassigned	Guide ready	VM execution pending
Lectures 9-10 injection	Unassigned	Guide ready	Highest exam priority
2025 mock exam	Unassigned	Walkthrough ready	Timed rerun pending

📖 Key Documents to Read First

Priority	Document	Time
Critical	Exam-Day Open Notes	Keep open
Critical	Focus Points	10 min
Critical	Tooling Overview	20 min
Critical	Complete Lecture Exercise Workbook	Multi-day
Critical	Exam Terms and Tools Glossary	Keep open
Critical	2025 Verified Walkthrough	60-90 min
Useful	Exam Checklist	10 min

🚀 Next Steps for Prep

[ ] Read source-backed focus points
[ ] Verify the analysis VM and clean snapshot
[ ] Complete static-analysis exercises
[ ] Master ProcMon filters and trace saving
[ ] Master APIMiner and injection API stages
[ ] Complete persistence/networking exercises
[ ] Reproduce the 2025 exam under time pressure
[ ] Export and inspect the final PDF submission

💡 Study Strategy

What to Focus On

Tier 1:

CFF Explorer and DiE
packing/entropy analysis
ProcMon filtering
APIMiner/API interpretation
Process Hacker processes, memory, and threads
process-injection stages
screenshot-based reporting

What's Less Important

Tier 2:

hashing and file identification
PE headers and memory mapping
persistence with Autoruns/Regshot
FakeNet and Wireshark

Avoid

Tier 3:

deep manual reversing before practical workflows are mastered
kernel/rootkit techniques not exercised in the source material

❓ Common Questions

Q: Where do I start? A: Read README.md then notes/00-focus-points.md

Q: What tools are most important? A: CFF Explorer/DiE, ProcMon, APIMiner, and Process Hacker. The 2025 injection question alone was worth 40 percent.

Q: How long to prepare? A: 1-2 days intensive with lectures + 1 day practice

Q: What should I memorize? A: Tool workflows, ProcMon operations, PE packing indicators, and injection API families. Understand API context rather than memorizing one rigid chain.

Q: Can I use notes during exam? A: Depends on exam rules — prepare as if you can't

Q: Are all workbook results already verified? A: No. Steps are source-backed; sample-specific observations must be completed inside the university VM.

📞 Contributing

When you add materials:

Create a clear descriptive name
Document it in the folder structure
Link it from relevant notes/ files
Update stories/001-project-status.md

📝 Repository Version

Created: June 15, 2026 Last Updated: June 15, 2026 Status: Source extraction complete; hands-on VM verification in progress

Good luck with your exam preparation! Focus on practical execution, not theory. 🎯