Source: Juni_2026_Exams/Advance_Forensics/notes/11-material-audit-and-study-plan.md

Material Audit and Study Plan

Evidence Status

Audit date: June 15, 2026

• Seven lecture PDFs and the actual 2025 exam/answer PDFs are available in

reference_pdfs/.

• The old DOCX metadata remains historical; it is no longer a blocker.
• solutions/previous-exam-solution-walkthrough.md remains a generic template.
• solutions/exam-2025-verified-walkthrough.md is the source-backed exam guide.
• notes/13-lecture-exercises-step-by-step.md contains the extracted lecture

exercises.

The source material shows that this module is primarily practical malware analysis, not disk-image/registry forensics. Use notes/00-focus-points.md as the current priority list. The remaining sections of this older plan are useful as supplemental Windows-forensics material.

What to Master First

Priority 1: Evidence handling and navigation

Be able to do this without notes:

1. Identify the evidence type: E01, raw/dd, segmented image, live system, or

memory dump.

1. Record the source, work from a copy, and calculate/verify hashes.
2. Open the image in FTK Imager or Autopsy.
3. Identify partitions, Windows version, users, and timezone.
4. Export artifacts while preserving their names and documenting paths.

Tools: FTK Imager, Autopsy, file, and a hashing tool such as Get-FileHash, sha256sum, or certutil.

Priority 2: Windows Registry

Master Registry Explorer and know which hive answers which question:

• SOFTWARE: Windows information, installed software, system Run keys.
• SYSTEM: computer name, timezone, USB/network data, services, shutdown.
• SAM: local accounts and account metadata.
• NTUSER.DAT: per-user activity and persistence.
• UsrClass.dat: ShellBags and other per-user Explorer artifacts.

Important offline-hive rule: CurrentControlSet is a live-registry alias. Resolve SYSTEM\Select\Current and examine the corresponding ControlSet00x, unless the parser resolves it for you.

Tools: Registry Explorer and RECmd. RegRipper is useful as a second parser, not as a substitute for validating the source key.

Priority 3: Execution and user-activity artifacts

Practice correlating, rather than relying on one artifact:

• Prefetch
• UserAssist
• Amcache
• Shimcache/AppCompatCache
• LNK files
• Jump Lists
• RecentDocs and Open/Save MRUs
• Browser history/downloads
• PowerShell history and event logs

Tools: PECmd, AppCompatCacheParser, AmcacheParser, LECmd, JLECmd, Registry Explorer/RECmd, BrowsingHistoryView or a SQLite viewer, and EvtxECmd.

Priority 4: NTFS and deleted-file analysis

Understand $MFT, $UsnJrnl:$J, $LogFile, $Recycle.Bin, resident data, file-record reuse, and the difference between metadata discovery and content recovery.

Tools: MFTECmd, MFT Explorer, Timeline Explorer, and FTK Imager/Autopsy.

An MFT entry can show that a file existed and was marked deleted; it does not automatically recover the deleted file's content.

Priority 5: Timeline and persistence

Normalize timestamps to UTC, retain raw values, and identify each source. Correlate at least two independent artifacts before making a strong claim.

Check persistence in:

• Run/RunOnce keys
• Services
• Scheduled Tasks
• Startup folders
• WMI persistence, if covered by lectures

Tools: Timeline Explorer, KAPE, Eric Zimmerman's parsers, Registry Explorer, Autoruns for live triage, and event-log parsers.

Priority 6: Memory forensics

Only promote this higher after checking the lectures or past exam. If a memory image is supplied, know the basic Volatility 3 workflow:

• identify OS/context
• process listing and process trees
• command lines
• network connections
• DLLs/handles
• suspicious memory regions and extraction

Important Corrections to Existing Notes

• RegisteredOwner is a configured registration value, not proof of the

person's identity or ownership.

• InstallDate may reflect an upgrade/reset rather than the machine's first

installation. Corroborate it.

• LNK and RecentDocs artifacts support file interaction, but do not always

prove that a target executed.

• UserAssist is useful execution evidence for Explorer-launched GUI programs,

but absence is not proof that a program never ran.

• A registry key's last-write time applies to the key, not necessarily to the

exact time an individual value was created.

• File access times may be disabled, delayed, or changed by examination.
• Created-after-modified timestamps can result from copying and are not, by

themselves, anti-forensic evidence.

• $MFT metadata, LNK target timestamps, and filesystem timestamps describe

different objects. Label the source of every timestamp.

• SYSTEM\CurrentControlSet\Services\EventLog\System\(timestamp) is not an

alternate Windows installation-date artifact.

• A normal BootExecute value such as autocheck autochk * is expected and

is not automatically suspicious.

Seven-Day Practical Plan

Answer Format

For each finding, write:

1. Direct answer.
2. Artifact and exact source path.
3. Tool/parser used.
4. Raw value and interpreted value.
5. Timestamp with timezone.
6. Corroborating artifact.
7. Confidence and limitation.

Do not include remediation unless the question asks for it. A forensic answer should distinguish observed evidence from interpretation.

Current Exam-Specific Material

The source extraction is complete:

• exam questions and mark allocations are mapped in

solutions/exam-2025-verified-walkthrough.md

• lecture tools and exercises are mapped in

notes/13-lecture-exercises-step-by-step.md

• current priorities are in notes/00-focus-points.md

The remaining requirement is hands-on verification in the university VM. Record sample-specific observations and screenshots without committing malware binaries or VM disks.