Source: Juni_2026_Exams/Advance_Forensics/notes/12-guided-practical-workbook.md

Guided Practical Workbook

Scope

This workbook consolidates the repository's supplemental disk-forensics exercises. It is not the lecture-derived malware-analysis workbook. For the uploaded 2026 lectures, use notes/13-lecture-exercises-step-by-step.md. Do not invent results when evidence is unavailable.

Use a Windows forensic workstation and a legally obtained practice image. Replace paths and observations in brackets with values from your evidence.

Lab Workspace

Create this structure before beginning:

D:\Forensics-Lab\
├── 00-Original\
├── 01-Working-Copy\
├── 02-Exports\
│   ├── Registry\
│   ├── MFT\
│   ├── LNK\
│   ├── EventLogs\
│   └── SuspiciousFiles\
├── 03-Parser-Output\
├── 04-Screenshots\
└── 05-Notes\

Record:

Case:
Evidence filename:
Evidence type:
SHA-256:
Tool and version:
Examiner:
Start time in UTC:
Evidence timezone:

Why: repeatable notes distinguish observations from interpretation and allow another examiner to reproduce the result.

Exercise 1: Load and Survey an Image

Goal: Open evidence correctly and identify the Windows partition and users.

Tool: FTK Imager

1. Start FTK Imager.
2. Select File → Add Evidence Item.
3. Choose Image File. Use Physical Drive only for an authorized live

device and preferably through a write blocker.

1. Select the first segment, such as .E01, .001, or .dd.
2. Expand the evidence tree and identify each partition.
3. Find the partition containing Windows, Users, and Program Files.
4. Open Users and list profile directories. Exclude obvious service profiles

only after recording them.

1. Inspect Windows\System32\config and confirm that SYSTEM, SOFTWARE,

SAM, SECURITY, and DEFAULT exist.

1. Take a screenshot showing the evidence tree and Windows partition.

Why each step matters: Selecting the wrong partition produces missing or irrelevant artifacts. User-profile names identify where per-user hives, LNK files, browser data, and PowerShell history may exist.

Record:

Exercise 2: Export Registry Hives Correctly

Goal: Export system and user hives with transaction logs.

1. In FTK Imager, open Windows\System32\config.
2. Export SOFTWARE, SYSTEM, SAM, SECURITY, and DEFAULT.
3. Export matching .LOG1 and .LOG2 files where present.
4. For every user, export C:\Users\[user]\NTUSER.DAT and its logs.
5. Export

C:\Users\[user]\AppData\Local\Microsoft\Windows\UsrClass.dat and its logs.

1. Rename only the destination copies so ownership remains obvious, for

example john-NTUSER.DAT.

1. Record source path, destination path, size, and hash.
2. Compare exported sizes with the sizes shown in FTK Imager.

Why: A hive without its logs can omit recent updates. Labeling prevents one user's activity from being attributed to another.

Success test: Registry Explorer can parse every exported hive, and no file is zero bytes.

Exercise 3: Load Hives in Registry Explorer

Goal: Understand the difference between a hive file and a live registry path.

1. Open Registry Explorer.
2. Load the exported SOFTWARE hive.
3. If transaction logs are detected, recover them into a working copy and note

that recovery occurred.

1. Navigate from the loaded root to:

Microsoft\Windows NT\CurrentVersion.

1. Locate ProductName, RegisteredOwner, and InstallDate.
2. Record the logical path as:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

1. Load SYSTEM in a separate tab.
2. Open Select and record Current.
3. If Current = 1, use ControlSet001; if Current = 2, use

ControlSet002.

1. Load SAM, each NTUSER.DAT, and each UsrClass.dat, keeping clear user

labels.

Interpretation: RegisteredOwner is a configured string, not proof of the real owner. InstallDate can reflect an upgrade or reset.

Record:

Exercise 4: Identify the System

Goal: Answer basic system-identification questions with exact sources.

1. In SOFTWARE, open

Microsoft\Windows NT\CurrentVersion.

1. Record ProductName, CurrentBuild or CurrentBuildNumber,

RegisteredOwner, and InstallDate.

1. In the active SYSTEM\ControlSet00x, open

Control\ComputerName\ComputerName.

1. Record the ComputerName value.
2. Check Services\Tcpip\Parameters for Hostname and compare it.
3. Locate timezone information under

Control\TimeZoneInformation.

1. Convert InstallDate only after verifying its data type and timestamp

format.

Expected conclusion: State exactly what each value says. Do not call RegisteredOwner the confirmed owner.

Exercise 5: Convert and Explain Timestamps

Goal: Convert timestamps without losing source or timezone context.

1. Copy the raw InstallDate value.
2. Record whether it is decimal, hexadecimal, binary FILETIME, or text.
3. Open DCode and choose the matching format.
4. Convert to UTC.
5. Record local time only after identifying the evidence system's timezone and

daylight-saving state for that date.

1. Repeat for SYSTEM\ControlSet00x\Control\Windows\ShutdownTime.
2. Preserve the raw value beside the converted result.
3. Sanity-check the result against other case dates.

Do not: Remove arbitrary bytes from a FILETIME value or assume every registry timestamp uses the same format.

Exercise 6: Enumerate User Accounts

Goal: Identify local accounts without guessing from profile folders alone.

1. Load SAM.
2. Navigate to SAM\Domains\Account\Users\Names.
3. Record each username and associated RID.
4. Review the corresponding RID key under Users.
5. Use a trusted parser for binary account metadata rather than manually

guessing offsets.

1. Compare accounts with directories under C:\Users.
2. Explain discrepancies, such as an account without a profile or a deleted

account with a remaining profile.

Record: username, RID, account state if reliably parsed, profile path, and the tool used.

Exercise 7: Recent Documents and UserAssist

Goal: Investigate user activity while respecting artifact limitations.

1. Load one user's NTUSER.DAT.
2. Open

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs.

1. Record MRUListEx ordering and relevant entries.
2. Note filenames and extension subkeys; use a parser if binary values are not

rendered clearly.

1. Open

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist.

1. Expand each GUID's Count key.
2. Decode ROT13 value names or use Registry Explorer's available decoding.
3. Record execution count and last-run time only when the parser exposes them

reliably.

1. Correlate an interesting item with Prefetch, Amcache, LNK, or event logs.

Interpretation: RecentDocs supports recent file interaction. UserAssist is useful for Explorer-launched GUI execution. Neither artifact is a complete history, and absence does not prove an event did not occur.

Exercise 8: Export and Analyze LNK Files

Goal: Recover target paths and contextual metadata from shortcuts.

1. Export all files from

C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent.

1. Keep original directory structure and filenames.
2. Parse them with LECmd or the supplied LNK analyzer.
3. Export parser results to CSV.
4. For each relevant shortcut, record target path, volume information,

working directory, arguments, machine ID if available, and all labeled timestamps.

1. Compare the LNK filesystem timestamps with target timestamps stored inside

the LNK. They describe different objects.

1. Correlate the target with RecentDocs and $MFT.

Do not claim: that every target executed or that an LNK target timestamp is the time the shortcut was opened.

Exercise 9: Export and Load $MFT

Goal: Find file records and distinguish metadata from content.

1. At the NTFS partition root in FTK Imager, locate $MFT.
2. Export it to 02-Exports\MFT.
3. Record source path, size, and hash.
4. Load it in MFT Explorer or parse it with MFTECmd.
5. Confirm columns for record number, in-use/deleted state, parent path,

$STANDARD_INFORMATION timestamps, and $FILE_NAME timestamps.

1. Search a known Windows file to verify parsing.

Why: NTFS commonly stores two timestamp sets. Always state which attribute produced a time.

Exercise 10: Find Deleted Executables

Goal: Locate deleted .exe records without calling every executable malware.

1. Filter for records marked deleted/not in use.
2. Filter the filename extension to .exe.
3. Record at least three results if the evidence contains them.
4. Capture full path, record number, size, and both timestamp sets.
5. Check whether the record has resident data.
6. Attempt content recovery separately through FTK Imager/Autopsy if required.
7. Hash recovered content and identify its file type.
8. Assess suspiciousness using path, filename, signature, hash, execution

artifacts, and persistence evidence.

Interpretation: “Deleted executable” is an observation. “Malware” requires additional evidence.

Exercise 11: Search for PowerShell Scripts

1. Search $MFT for .ps1, .psm1, and .psd1.
2. Record current and deleted results.
3. Check paths under user Downloads, Desktop, Temp, and script directories.
4. Export available files and inspect them as text.
5. Search PowerShell history at:

C:\Users\[user]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.

1. Check PowerShell event logs if present.
2. Correlate script path and time with execution evidence.

Safety: Do not execute recovered scripts.

Exercise 12: Persistence Investigation

Goal: Find configuration that can cause automatic execution.

1. Check system Run and RunOnce keys in SOFTWARE.
2. Check Run and RunOnce in every NTUSER.DAT.
3. Resolve the active SYSTEM control set.
4. Review services with automatic or boot/system start values and inspect

ImagePath, ServiceDll, and account configuration.

1. Export and inspect C:\Windows\System32\Tasks.
2. Correlate task files with the TaskCache registry keys.
3. Inspect user and all-users Startup folders.
4. Treat the normal BootExecute value autocheck autochk * as expected.
5. Verify every referenced executable against the filesystem and execution

artifacts.

Finding format:

Observed:
Artifact and path:
Value/task/service:
Referenced executable:
File exists:
Corroboration:
Assessment:
Limitation:

Do not report a registry value creation time unless the artifact truly provides one. A key last-write time is not automatically the creation time of an individual value.

Exercise 13: Build a Correlated Timeline

Goal: Build a defensible timeline, not merely sort unrelated dates.

1. Select one event hypothesis, such as “suspicious executable introduced and

configured for persistence.”

1. Collect timestamps from $MFT, Prefetch, UserAssist, LNK/Jump Lists,

registry keys, event logs, and persistence artifacts.

1. Preserve source, raw timestamp, parser, timezone, and interpretation.
2. Normalize a copy to UTC while retaining original values.
3. Sort chronologically.
4. Separate facts from inference.
5. Require corroboration before claiming execution or compromise.

Created-after-modified timestamps may result from copying. File access times may be disabled or delayed. Neither condition alone proves anti-forensics.

Exercise 14: Full Mock Investigation

Answer these using only observed evidence:

1. What Windows system and hostname are represented?
2. Which local users and profiles exist?
3. What configured registration information exists?
4. What recent file activity is supported?
5. Which programs have evidence of execution?
6. Are deleted executable or script records present?
7. Is persistence configured?
8. When was the last recorded clean shutdown?
9. What is the most defensible incident timeline?
10. Is compromise supported, suspected, or not established?

For every answer include:

• direct answer
• tool and version
• artifact and exact source
• raw and interpreted value
• UTC timestamp where relevant
• corroboration
• confidence
• limitation

Completion Standard

You have completed the workbook when you can:

• load an image and export artifacts without modifying evidence
• load hives with their transaction logs
• resolve an offline SYSTEM control set
• keep users and timestamp sources separate
• parse LNK and MFT artifacts without overstating them
• identify and corroborate persistence
• produce a UTC timeline with explicit sources
• distinguish observation, interpretation, and conclusion

When lecture PDFs are added, create a “Lecture Exercises” section and map each lecture task to the closest workbook exercise. Add new exercises only where the lecture introduces a distinct artifact or workflow.