ZEKASTRA FORENSIC - CASE PACK VP-01 - WINDOWS TRIAGE
SYNTHETIC TRAINING DATA. The organisation, people, devices, serial numbers and times are invented.
Do not use these files as evidence of anything. Nothing here was taken from a real computer.

Scenario (EN)
Kestrel Logistics (invented) closes its office at weekends. An internal audit asks three things about the
payroll workstation PAY-WS03: was it used on Saturday 14 March 2026; under which account; and did payroll
data leave the machine on removable storage. On Monday 16 March 2026 an IT technician (account t.kaya) took
a triage collection. The pack holds the parser output of that collection, not the raw artifacts.

Senaryo (TR)
Kestrel Lojistik (uydurma) hafta sonu kapalıdır. İç denetim, bordro iş istasyonu PAY-WS03 hakkında üç şey
soruyor: 14 Mart 2026 Cumartesi günü kullanıldı mı; hangi hesapla; ve bordro verisi taşınabilir bellekle
makineden çıktı mı. 16 Mart 2026 Pazartesi günü bir BT teknisyeni (t.kaya hesabı) triyaj toplaması yaptı.
Paket, o toplamanın ayrıştırıcı çıktısını içerir; ham artefaktları değil.

Files / Dosyalar
  security-events.csv       Security event log, exported (times UTC)
  system-events.csv         System event log, exported (times UTC)
  partition-diagnostic.csv  Microsoft-Windows-Partition/Diagnostic event 1006, exported (times UTC)
  prefetch.csv              Prefetch, parsed (times UTC)
  lnk-files.csv             LNK files from the Recent folder of d.aydin, parsed (times UTC)
  registry-excerpt.txt      SYSTEM, SOFTWARE and NTUSER.DAT excerpts (times UTC)
  manifest.txt              SHA-256 of every file above and of this README

Verify every file against manifest.txt before you start, and record the result in your examination log.