Source: Juni_2026_Exams/Advance_Forensics/solutions/previous-exam-solution-walkthrough.md

📋 Previous Exam Solution Walkthrough

IMPORTANT NOTICE

This template shows how to answer forensic exam questions using the standard format.

When you upload the actual previous exam, follow this structure for each question:

Question Answer Format

## Question X: [Exact question text]

### Tool Used
[Which tool? FTK Imager, Registry Explorer, MFT Explorer, DCode, LNK Analyzer]

### Artifact(s)
[What registry hive or file? SOFTWARE, SYSTEM, SAM, NTUSER.DAT, $MFT, .lnk files]

### Registry Path / File Location
[Exact path where you found the answer]

### Steps Performed
1. [Step 1]
2. [Step 2]
3. [Step 3]
4. [Step 4]
5. [Step 5]

### Evidence Found
[Screenshots/results of what you found]

### Final Answer
[Clear, concise answer to the question]

### Confidence
[High / Medium / Low]

### Notes
[Any important context or edge cases]

Example Answer (Template)

## Question 1: What is the registered owner of this computer?

### Tool Used
Registry Explorer

### Artifact
SOFTWARE hive

### Path
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner

### Steps Performed
1. Opened forensic image in FTK Imager
2. Navigated to C:\Windows\System32\config\
3. Exported SOFTWARE hive to D:\Evidence\Registry\SOFTWARE
4. Opened SOFTWARE hive in Registry Explorer
5. Navigated to Microsoft\Windows NT\CurrentVersion
6. Located RegisteredOwner value

### Evidence Found
Value: "RegisteredOwner" = "John Doe"

### Final Answer
The registered owner is John Doe.

### Confidence
High
(Direct registry entry, no interpretation needed)

### Notes
This is the primary system owner registration.

Example Answer 2 (Timestamp Conversion)

## Question 2: When was Windows installed?

### Tool Used
Registry Explorer + DCode

### Artifact
SOFTWARE hive

### Path
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

### Steps Performed
1. Found InstallDate value: 1577836800
2. Opened DCode
3. Selected: Unix timestamp
4. Pasted: 1577836800
5. Converted to: 2020-12-31 12:00:00 UTC

### Evidence Found
InstallDate (Unix timestamp): 1577836800

### Final Answer
Windows was installed on December 31, 2020 at 12:00 UTC.
Local time (CET): December 31, 2020 at 13:00 CET (UTC+1)

### Confidence
High

### Notes
Unix timestamp format uses seconds since 1970-01-01
DCode conversion is accurate for timestamp interpretation

Example Answer 3 (MFT Analysis)

## Question 3: Find any deleted malware files

### Tool Used
MFT Explorer

### Artifact
$MFT file

### Steps Performed
1. Exported $MFT from forensic image using FTK Imager
2. Opened $MFT in MFT Explorer
3. Enabled filter: "Show deleted entries"
4. Searched for: "*.exe"
5. Reviewed results for suspicious locations

### Evidence Found
Deleted file: malware.exe
├─ Entry Number: 12345
├─ Full Path: C:\Users\John\AppData\Local\Temp\malware.exe
├─ File Size: 245120 bytes
├─ Created: 2021-08-09 14:30:45 UTC
├─ Modified: 2021-08-09 14:42:30 UTC
├─ Accessed: 2021-08-10 08:15:00 UTC
└─ Status: DELETED (MFT entry marked as deleted)

### Final Answer
Found 1 deleted executable file:
- Name: malware.exe
- Original Location: C:\Users\John\AppData\Local\Temp\
- Created: 2021-08-09 14:30 UTC
- File Size: ~245 KB
- Assessment: SUSPICIOUS (Temp folder + executable)

### Confidence
High

### Notes
File was in AppData\Local\Temp\ which is typical for downloaded/executed malware
Creation and access times suggest active execution before deletion

Example Answer 4 (Persistence)

## Question 4: Is there evidence of persistence?

### Tool Used
Registry Explorer

### Artifacts
SOFTWARE and NTUSER.DAT hives

### Paths
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

### Steps Performed
1. Opened NTUSER.DAT in Registry Explorer
2. Navigated to Software\Microsoft\Windows\CurrentVersion\Run
3. Found suspicious entries
4. Verified executable paths exist
5. Checked timestamps in MFT

### Evidence Found
User-Level Run Key:

"Windows Update" = "C:\Windows\Temp\malware.exe"


System-Level Run Keys:

[No suspicious entries]


### Final Answer
YES - Evidence of persistence found

Persistence Mechanism:
- Type: Registry Run Key (User-Level)
- Location: NTUSER.DAT\...\Run
- Entry: "Windows Update" → C:\Windows\Temp\malware.exe
- Impact: Malware executes automatically when user logs in
- File Status: Exists in MFT (malware.exe at C:\Windows\Temp\)

Recommendation:
- Malware will re-execute after system restart
- Requires removal of registry entry AND deletion of executable

### Confidence
High

### Notes
Entry name "Windows Update" is deceptive
Temp folder location is suspicious
Executable confirmed in MFT

Example Answer 5 (Timeline)

## Question 5: Create timeline of suspected breach

### Tools Used
Registry Explorer, MFT Explorer, LNK Analyzer, DCode

### Steps Performed
1. Collected all timestamps from multiple sources
2. Converted all to UTC format using DCode
3. Sorted chronologically
4. Correlated events

### Timeline

2020-12-31 12:00 UTC
└─ SYSTEM INSTALLATION
   Source: SOFTWARE hive, InstallDate

2021-08-05 15:30 UTC
└─ SUSPICIOUS FILE DOWNLOADED
   File: malware.exe
   Location: C:\Users\John\Downloads\
   Source: MFT Created timestamp

2021-08-09 14:30 UTC
└─ MALWARE EXECUTED
   Event: malware.exe launched
   Location: C:\Users\John\AppData\Local\Temp\
   Source: Registry UserAssist (decoded)

2021-08-10 08:15 UTC
└─ LATERAL MOVEMENT ATTEMPT
   File: backdoor.exe accessed
   Source: LNK file (shortcut) access

2021-08-10 14:30 UTC
└─ PERSISTENCE ESTABLISHED
   Event: Added to Run registry key
   Source: Registry ShutdownTime + UserAssist

2021-08-10 18:30 UTC
└─ FINAL USER ACTIVITY
   Event: User opened suspicious files
   Source: RecentDocs registry

2021-08-10 18:45 UTC
└─ SYSTEM SHUTDOWN
   Source: SYSTEM hive, ShutdownTime (converted)
   Value: 01D123456789ABCD → 2021-08-10 18:45:32 UTC

Analysis

The attack progression shows:

Initial compromise (download)
Execution attempt
Persistence establishment
Lateral movement planning
System shutdown

Confidence

Medium-High (based on available artifacts, could have gaps)

Notes

Timeline based on forensic artifacts (may not be complete) Assumes artifact timestamps are not spoofed


---

## Question Mapping Table

Create this table from all previous exam questions:

Q#	Question	Tool	Artifact	Path	Answer Format
1	Owner?	Registry Explorer	SOFTWARE	RegisteredOwner	String (name)
2	Install date?	Registry + DCode	SOFTWARE	InstallDate	Date/Time (UTC)
3	Computer name?	Registry Explorer	SYSTEM	ComputerName	String (hostname)
4	Shutdown time?	Registry + DCode	SYSTEM	ShutdownTime	Date/Time (UTC)
5	Recent files?	Registry Explorer	NTUSER.DAT	RecentDocs	List of filenames
6	Programs run?	Registry Explorer	NTUSER.DAT	UserAssist	List (decode ROT13)
7	Deleted files?	MFT Explorer	$MFT	All entries	List with paths
8	Persistence?	Registry Explorer	SOFTWARE/NTUSER.DAT	Run keys	Path → executable
...	...	...	...	...	...


---

## Scoring Rubric (for your reference)

Full Points (100%):

Correct answer ✓
Correct tool mentioned ✓
Correct artifact/path ✓
All steps documented ✓
Evidence clearly stated ✓
Proper timestamps (UTC) ✓

High Points (70-90%):

Correct answer
Tool mentioned
Most steps clear
Some evidence provided

Medium Points (40-70%):

Partially correct answer
Tool mentioned
Some steps clear
Limited evidence

Low Points (<40%):

Wrong answer or incomplete
No tool mentioned
Steps unclear
No evidence provided


---

## How to Use This Template

1. When you upload the previous exam PDF, create this file:
   `solutions/previous-exam-solution-walkthrough.md`

2. For each question from the exam:
   - Create a section (## Question X)
   - Follow the template structure above
   - Be detailed about steps and evidence
   - Include all relevant paths and timestamps

3. At the end, create the question mapping table for quick reference

---

## Next Steps

- ✅ Upload previous exam PDF to `exams/`
- ✅ Extract each question
- ✅ Work through each using tools
- ✅ Document answers using this template
- ✅ Create final mapping table

---

**Last Updated:** June 15, 2026