ZEKASTRA case pack VP-06 - acquisition log - SYNTHETIC TRAINING DATA

Case: Kuzey Lojistik A.S. - accounting workstation KZL-MUH07 - internal reference KZL-2026-031
Collected by: incident response examiner, account ir.examiner
All times UTC.

2026-06-16 10:21:30  User d.ercan reports a changed wallpaper and a note on the desktop (call to the IT desk).
2026-06-16 10:27:00  IT disables the switch port of KZL-MUH07. The workstation stays powered on.
2026-06-16 12:40:15  Live response session (console): Sysmon/Operational, Security and Defender/Operational .evtx copied with the raw-copy tool; parsed with EvtxECmd.
2026-06-16 12:46:02  $MFT and $UsnJrnl:$J of C: copied; parsed with MFTECmd; journal window filtered as stated in export-metadata.txt.
2026-06-16 12:48:40  C:\Users\d.ercan\Desktop\OKU_BENI.txt copied.
2026-06-16 12:52:10  Workstation shut down for imaging.
2026-06-16 14:05:00  Mail gateway MX-KZL01: message log exported for the window in local time as stated.
2026-06-16 14:20:00  Hashes computed for every file and written to manifest.txt.

Clock check at collection: KZL-MUH07 agreed with the domain time source within 1 second. MX-KZL01 showed 17:04:59 local time at 14:04:59 UTC.