Begin Exam Try 2 (5)
When did the windows image acquisition start?
Answer in YYYY-MM-DD HH:MM:SS
Go to where we have the evidence stored and there is a text document for the output of FTK Imager. We can see the acquisition started on 2020-04-22 17:55:30.
Call Me Maybe? (5)
What is the user's phone number? (Format: 555-555-5555)
The first thing that came to mind when looking for a phone number was Google Autofill. We got lucky and the user Warren had it saved under his profile. His number is 802-265-5115.
Feelin' Lucky? (5)
How many people won Quarterly Drawing 31?
A quick search for “Quarterly Drawing 31” reveals a Vermond 2nd Chance Lottery ticket. If we Google the lottery, we can see from the history of the lottery draw, they had 100 winners for that drawing.
Update the Résumé (5)
When did the user start working in their current position?
(Example: flag<July 1776>)
From Chrome Login artifacts we can see the user accessed his LinkedIn account using a Gmail account.
A quick search and a hint of location information, we can see Warren started working at Mallie Sae on July 2014.
Another day, another dollar (10)
How many times did Warren sign in to his machine?
AXIOM parses this from the SAM file, we can see Warren logged in 24 times.
Hash Crash (10)
What is the earliest created file associated with the following MD5: 3d908e1b40140c1e0167603ffca07701
Using FTK Imager I created a full file hash list for the E01 image. There were only two hits for that MD5 hash. Doing a search of each file name, AccessMUISet.msi had a created date 4 hours before 3a7a1c9.msi.
Sticky Situation (10)
How many dollars does the user CURRENTLY owe from gambling? Format 99,900
Hunting in the documents folder for the user we can see a loan sheet:
We can add the amount due minus the amounts paid and see that he still owes $16,080.
Money, money, money, Money! (25)
How many dollars to directly buy in to the tournament on Sunday?
A quick search for “tournament” yielded one rebuilt webpage for us to browse and see pulled from WebCache. The answer was 162 dollars.
Sorry, eh? (25)
When was the image downloaded from www.sciencenews.org viewed? Format MM/DD/YYYY HH:MM:SS (24 hour clock) ex 05/12/2020 17:45:00
A quick keyword search for www.sciencenews.org we see one image was downloaded.
Since we want to know when the file was actually viewed we can look at LNK files for the poker.jpg.
The creation of a LNK file usually indicates the file first opening/viewed, which we see was 02/18/2020 21:25:36.
Stay PAWsitive (25)
What is the name of the movie written in the text file within a PNG?
Once again, the question title gives a clue. I was able to find a folder labeled “Cats” with some pictures, only one of which was a PNG file.
I exported it out and opened it with OpenStego, a common steganography tool.
With no need for a password, the exported text file has the answer. Godzilla.
What happens when you text and drive? (25)
Name the bug check code in the most recent Windows crash (Blue Screen)
Blue screen crash logs can be located at C:\Windows\Minidump. There are two so we can export the folder and view them in the free tool from Nirsoft, BlueScreenView and see the Bug Check code was 0x0000000a for the most recent crash.
You're GUIDing, right? (25)
What is the GUID for the application that was last used to access C:\Users\Warren\Documents?
AXIOM pulls that one out fairly quickly after searching for the folder path. We can look under MRU Folder Access to find the GUID of 4ED5B83C-7A8C-4917-B107-E9FF0864EDFB.
Poker, I don't even... (50)
How many total seconds did the user spend on the page when they searched for quick online poker? format: x.xxx
A simple keyword search in AXIOM for “quick online poker” brings up 2 Chrome web history files.
Using Ryan Benson’s awesome tool Unfurl we can try out both searches. The answer they were looking for was found for the “quick online poker tips” search, 6.294 seconds.