Source: Juni_2026_Exams/Advance_Forensics/solutions/exam-answer-template.md

📝 Exam Answer Template

Use This for Practice & Exam

Copy this template for each practice question or exam question.

Question X

Question: [Copy exact question text here]

Tool used: [Which tool? FTK Imager, Registry Explorer, MFT Explorer, DCode, LNK Analyzer, etc.]

Artifact: [What registry hive or file? SOFTWARE, SYSTEM, SAM, NTUSER.DAT, $MFT, .lnk files, etc.]

Path: [Full path to registry key or file location]

Example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
Example: C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent\
Example: HKLM\SYSTEM\CurrentControlSet\Control\Windows\ShutdownTime

Steps performed:

[First step - what did you do?]
[Second step]
[Third step]
[Fourth step]
[Fifth step - continue as needed]

Evidence found: [What did you actually find? Quote values, note paths, describe findings]

Example:
RegisteredOwner = "John Doe"
ProductName = "Windows 10 Pro"
InstallDate = 1577836800 (raw value)

Conversion/Interpretation: [If needed, show conversion work]

Example for timestamps:
Raw value: 1577836800
Tool: DCode
Format: Unix timestamp
Converted: 2020-12-31 12:00:00 UTC
Local time (CET): 2020-12-31 13:00:00 CET (UTC+1)

Final answer: [Your answer to the question - be specific and concise]

Confidence: [ ] High [ ] Medium [ ] Low

Why this confidence level: [Explain your confidence - direct evidence, no interpretation needed, etc.]

Additional notes: [Any important context or limitations]

Example:
- Verified timestamp is not spoofed (created < modified)
- File still exists in MFT (not completely deleted)
- No conflicting evidence found
- Checked all user accounts, only John Doe found

Completed Example

Question: Who is the registered owner of this computer and when was Windows installed?

Tool used: Registry Explorer + DCode

Artifact: SOFTWARE hive (from HKLM)

Path:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

Steps performed:

Opened forensic image in FTK Imager
Navigated to C:\Windows\System32\config\
Right-clicked SOFTWARE file → Export → Exported to D:\Evidence\Registry\
Opened Registry Explorer
File → Open Registry Hive → Selected D:\Evidence\Registry\SOFTWARE
Navigated to Microsoft\Windows NT\CurrentVersion
Found RegisteredOwner = "John Doe"
Found InstallDate = "1577836800"
Opened DCode
Selected Unix timestamp input format
Pasted 1577836800
Converted to 2020-12-31 12:00:00 UTC

Evidence found:

Registry Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Value: RegisteredOwner = "John Doe"
Value: ProductName = "Windows 10 Pro"
Value: InstallDate = 1577836800 (Unix timestamp)

Conversion/Interpretation:

Raw value: 1577836800
Tool: DCode
Format: Unix timestamp (seconds since 1970-01-01)
Converted: 2020-12-31 12:00:00 UTC
Local time (CET): 2020-12-31 13:00:00 CET (UTC+1)

Final answer: The computer is registered to John Doe and Windows was installed on December 31, 2020 at 12:00 UTC (13:00 CET). The system is running Windows 10 Pro.

Confidence: [X] High [ ] Medium [ ] Low

Why this confidence level: Direct registry values with no interpretation needed. RegisteredOwner is a simple string value. InstallDate was successfully converted using DCode. No conflicting evidence. This is basic system information stored in the primary registry location.

Additional notes:

InstallDate is stored as Unix timestamp, requires DCode conversion
RegisteredOwner can be changed by users, so may not reflect actual current owner
ProductName confirms Windows 10 Pro installation
Timestamps are consistent (no anomalies)

Tips for Using This Template

Before Starting

[ ] Have all evidence extracted (registry, $MFT, etc.)
[ ] Have tools open (Registry Explorer, MFT Explorer, DCode)
[ ] Read question carefully - what exactly is it asking?

While Working

[ ] Take screenshots of each step
[ ] Copy exact registry paths (don't type manually)
[ ] Use DCode for all timestamp conversions
[ ] Document everything as you go (don't memorize)

After Finding Answer

[ ] Double-check: Does my answer make sense?
[ ] Did I convert timestamps correctly?
[ ] Did I cite all evidence?
[ ] Is my formatting clear?
[ ] Rate your confidence honestly

Final Review

[ ] Question clearly restated
[ ] Answer directly addresses question
[ ] Evidence provided and cited
[ ] Tool and path documented
[ ] Timestamps converted and include timezone
[ ] No grammatical errors
[ ] Concise but complete

Common Answer Mistakes to Avoid

❌ Mistake 1: Not citing evidence

Wrong: "The owner is John Doe"
Right: "The owner is John Doe (found in SOFTWARE hive, RegisteredOwner value)"

❌ Mistake 2: Forgetting to convert timestamps

Wrong: "InstallDate = 1577836800"
Right: "InstallDate = 1577836800 (converted: 2020-12-31 12:00 UTC)"

❌ Mistake 3: Wrong timezone or missing timezone

Wrong: "Shut down at 18:45"
Right: "Shut down at 18:45 UTC (20:45 CET local time)"

❌ Mistake 4: Not explaining the tool used

Wrong: "The file was deleted"
Right: "The file was deleted (found in MFT with status flag: DELETED)"

❌ Mistake 5: Incomplete steps

Wrong: "I checked the registry"
Right: "I exported the SYSTEM hive, opened it in Registry Explorer, navigated to CurrentControlSet\Control\Windows, and found the ShutdownTime value"

Quick Checklist

Before submitting each answer:

[ ] Question number clearly marked
[ ] Answer directly responses question
[ ] Tool mentioned
[ ] Registry path or file location shown
[ ] Evidence quoted or described
[ ] Timestamps converted if applicable
[ ] Timezone specified if timestamps used
[ ] Confidence level rated
[ ] Concise but complete
[ ] No typos or formatting errors

Last Updated: June 15, 2026