Source: Juni_2026_Exams/Advance_Forensics/stories/003-open-tasks.md

📖 Story 003 - Open Tasks

🎯 Goal

Document all remaining work needed to complete the exam preparation repository.

📋 Task Breakdown

Category 1: Upload Required Materials

[ ] Task 1.1 - Upload all lecture PDFs to lectures/
[ ] Task 1.2 - Upload previous exam files to exams/
[ ] Task 1.3 - Upload exam questions document to exams/
[ ] Task 1.4 - Upload sample forensic images to exams/

Category 2: Extract & Document Lecture Content

[ ] Task 2.1 - Read lecture-01 PDF, extract exercises
[ ] Task 2.2 - Create notes/lecture-01-lab-exercises.md
[ ] Task 2.3 - Read lecture-02 PDF, extract exercises
[ ] Task 2.4 - Create notes/lecture-02-lab-exercises.md
[ ] Task 2.5 - Continue for all lectures...
[ ] Task 2.6 - Create summary table of all exercises

Category 3: Previous Exam Analysis

[ ] Task 3.1 - Analyze previous exam questions
[ ] Task 3.2 - Create solutions/previous-exam-solution-walkthrough.md
[ ] Task 3.3 - Document answer for each exam question
[ ] Task 3.4 - Create mapping table: Question → Tool → Artifact → Path
[ ] Task 3.5 - Add screenshots of tool workflows to solutions

Category 4: Screenshots & Examples

[ ] Task 4.1 - Screenshot FTK Imager loading forensic image
[ ] Task 4.2 - Screenshot Registry Explorer with key hives open
[ ] Task 4.3 - Screenshot DCode converting timestamps
[ ] Task 4.4 - Screenshot MFT Explorer with deleted files
[ ] Task 4.5 - Screenshot LNK file analysis
[ ] Task 4.6 - Add all screenshots to notes/

Category 5: Practical Exercises

[ ] Task 5.1 - Create 3 mock exam questions
[ ] Task 5.2 - Write detailed solutions for mock exams
[ ] Task 5.3 - Create a "first-time student" dry run scenario
[ ] Task 5.4 - Document common mistakes with examples

Category 6: Enhancement & Polish

[ ] Task 6.1 - Add command-line examples to tool guides
[ ] Task 6.2 - Create registry path flashcard format
[ ] Task 6.3 - Add "quick tips" sections to each tool guide
[ ] Task 6.4 - Create exam day checklist for tools & paths
[ ] Task 6.5 - Add "tricky questions" section
[ ] Task 6.6 - Final proofread all Markdown files

🔴 Blocking Issues

Issue	Impact	Status
University malware samples are not stored in Git	Cannot record sample-specific results outside the VM	In progress
Screenshots not yet collected	Exercise evidence is incomplete	In progress
Timed 2025 mock not yet recorded	Exam-speed readiness is unknown	In progress

📊 Effort Estimates

Task Category	Time Estimate	Priority
Upload materials	30 min	🔴 Critical
Extract lectures	3-4 hours	🟠 High
Analyze previous exam	2-3 hours	🟠 High
Add screenshots	2 hours	🟡 Medium
Practice exercises	2 hours	🟡 Medium
Polish & review	1-2 hours	🟢 Low
Total	~12 hours

🎯 Priority Matrix

🔴 Must Do (Before studying)

Complete lecture exercises in the designated VM
Record screenshots and exact observations
Complete a timed 2025 mock exam
Review findings for accuracy and reproducibility

🟠 Should Do (Before final prep day)

Add screenshots to guides
Create mock exam questions
Document common mistakes
Test tool workflows

🟡 Nice to Have (After exam if time permits)

Advanced scenarios
Video tutorials
Interactive quizzes
Tool comparison chart

📈 Completion Roadmap

Phase 1: Upload & Extract (Days 1-2)
├─ Upload all materials
├─ Extract lecture exercises
└─ Create exercise files
        ↓
Phase 2: Solution & Examples (Days 3-4)
├─ Create previous exam walkthrough
├─ Add screenshots
└─ Create mock exams
        ↓
Phase 3: Polish & Test (Day 5)
├─ Final proofread
├─ Verify all links work
└─ Do complete dry run

🔄 How to Track Progress

When working on a task:

Update this file: Change [ ] to [🔄] (in progress)
Update 001-project-status.md with new status
When done: Change to [✅] (completed)
Commit: git commit -m "Complete task X.X - description"

Example:

- [🔄] **Task 2.1** - Read lecture-01 PDF, extract exercises

After task done:

- [✅] **Task 2.1** - Read lecture-01 PDF, extract exercises

📝 Dependencies

Before Task 2.x can start:

✅ Task 1.1 (lectures uploaded)

Before Task 3.x can start:

✅ Task 1.2 (previous exam uploaded)

Before Task 4.x can start:

✅ Task 2.x completed (understand the exercises)

Before Task 5.x can start:

✅ Task 3.x completed (understand answer format)

✅ Definition of Done

A task is considered complete when:

[x] The work is done (exercises extracted, solutions written, etc.)
[x] Changes committed to git
[x] Related story/issue updated
[x] No blocking issues remain
[x] Someone new can understand what was done

📞 Questions for Implementation

Q: What lecture PDFs are available?
Q: What is the previous exam format? (PDF, image, archive?)
Q: Are screenshots required or optional?
Q: Should mock exams have model answers?
Q: Can we use external images or must we create new scenarios?

🎯 Success Criteria

When all tasks are complete:

[ ] ≥80% of lecture content is documented in exercises
[ ] All previous exam questions have detailed solutions
[ ] Exam answer template used for all solutions
[ ] All Tier 1 registry paths appear in documentation
[ ] Every tool has at least 1 screenshot example
[ ] Newcomer can study alone using this repo
[ ] Can do a full mock exam in <2 hours
[ ] Confidence level: "Ready to take exam"

Last Updated: June 15, 2026 Status: Awaiting material uploads to proceed