01Session plan
| Minutes | Block | What happens |
|---|---|---|
| 0–15 | Brief, rules and integrity (Q01) | Read export-metadata.txt aloud: which exports are local time, which record content, which record only metadata. |
| 15–55 | The stick (Q02–Q07) | Separate the two sticks by serial, then tie files to the unapproved one by volume serial number. Read TargetCreated against TargetModified, and test what ShellBags can say about E:. |
| 55–90 | Cloud and printer (Q08–Q11) | Filter the proxy on the upload host and the status; filter the print log on the user and the date. Write what each record does not contain. |
| 90–125 | Remote access (Q12–Q15) | Convert the VPN report to UTC, join the tunnel address to the type 10 logon, count out-of-hours sessions and read the refused attempt against the HR record. |
| 125–150 | The signed sentence (Q16) | Each trainee writes the finding in four channels with their limits, then compares it with sentence c and the model finding. |
Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →
02Answer key
Q011 point
On a copy of lnk-files.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.
Answer518d7f46
The prefix matches the manifest line. Opening the CSV in a spreadsheet and saving it again changes line endings and date formats, and with them the hash; hash the file as it was exported.
- Where
- manifest.txt, the lnk-files.csv line.
- Usual mistake
- Hashing a copy saved again by a spreadsheet.
Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration
Q022 points
Two USB storage devices appear on the workstation. Enter the serial number of the one that is not the approved stick listed in the HR record.
Answer4C530001050719102233
Partition/Diagnostic 1006 names a Kingston IronKey Vault Privacy 50 (serial E0D55EA5741F2026A0B30C12) and a SanDisk Ultra Fit (serial 4C530001050719102233). The HR record lists only the Kingston, inventory BT-ENV-0412. The SanDisk arrives twice, on 28 August and 11 September.
- Where
- partition-diagnostic.csv, SerialNumber; ik-kaydi.txt, Zimmetli aygıtlar.
- Usual mistake
- Entering the volume serial number 7A3E-11C2, which belongs to the file system, not the device, or the ParentId with the vendor and product IDs.
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)SOP-08 Examination notes and working record
Q032 points
When did the unapproved stick first arrive on the workstation? UTC, to the second.
Answer2026-08-28 16:38:12
The first 1006 event with the SanDisk serial and a non-zero capacity is at 16:38:12 UTC on Friday 28 August, 19:38 local time; it is removed at 17:21:40. The Security log shows the user logged on until 17:29:14, three hours after the usual departure.
- Where
- partition-diagnostic.csv, first row with SerialNumber 4C530001050719102233.
- Usual mistake
- Reading 16:38 as local time, or taking the removal row (capacity 0).
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)Local time to UTC
Q042 points
Where does the first copy to the unapproved stick fall against the resignation notice?
AnswerB — Before the notice: on 28 August at 16:44 UTC, about three and a half days before the notice at 06:12 UTC (09:12 local) on 1 September.
The earliest TargetCreated on volume 7A3E-11C2 is 2026-08-28 16:44:51 UTC (TRB-2026-Teklif-Fiyatlandirma.xlsx). The HR record writes the notice as 01.09.2026 09:12:37 local, 06:12:37 UTC. The second visit on 11 September and the uploads, prints and VPN sessions all fall after it. A first copy before the notice is a fact to report, not a motive to state.
- Where
- lnk-files.csv, TargetCreated of the rows with VolumeSerialNumber 7A3E-11C2; ik-kaydi.txt, İstifa bildirimi.
- Usual mistake
- Comparing 28 August UTC with 1 September local as if they were the same basis, or taking the second stick session as the first.
Q052 points
How many shortcuts in the Recent folder point to the unapproved stick's volume?
Answer8
The 1006 arrival rows give the SanDisk's volume serial number 7A3E-11C2. Eight shortcuts carry it: six files (three TRB-2026 files and the customer contact list on 28 August, KMR-2025-Teklif.xlsx and Birim-Fiyat-Analizi-2026.xlsx on 11 September) and two folders (E:\Yedek, E:\Yedek\Projeler). Two more E: shortcuts carry 5B10-2C7F, the approved Kingston.
- Where
- lnk-files.csv, VolumeSerialNumber; partition-diagnostic.csv, VbrVolumeSerial.
- Usual mistake
- Counting every E: shortcut (10), which mixes in the approved stick's delivery package.
LNK shortcut filesUSB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
Q062 points
The shortcut to E:\Yedek\Projeler\TRB-2026\TRB-2026-Teklif-Fiyatlandirma.xlsx has TargetCreated 2026-08-28 16:44:51 and TargetModified 2026-08-21 13:07:40. What does that pair say?
AnswerB — The file was written on E: on 28 August, and its content was last changed on 21 August: the pattern a copy leaves, because copying keeps the modification time and sets a new creation time.
Windows Explorer gives a copied file a new creation time on the destination and keeps its last-write time. A creation time after the modification time on the stick is the copy signature; the shortcut's MachineID arge-ws14 shows it was written on this workstation. It does not say the file was opened on the stick by someone else.
- Where
- lnk-files.csv, TargetCreated, TargetModified and MachineID of that row.
- Usual mistake
- Treating the reversed order as tampering.
Q072 points
ShellBags show My Computer\E: first interacted on 2025-06-11 and E:\Teslim on 2026-08-19. Can ShellBags alone say which device E:\Yedek was on?
AnswerC — No: ShellBags record the drive letter and the folder path, not the device. The volume serial number in the shortcuts (7A3E-11C2) and the stick sessions in 1006 tie E:\Yedek to the SanDisk.
Both sticks mounted as E:. ShellBags keep the shell item path and the times the folder was browsed; E:\Teslim belongs to the Kingston sessions and E:\Yedek to the SanDisk sessions only because the times fall inside those sessions and the shortcuts carry the volume serial numbers. ShellBags show browsing, not copying.
- Where
- shellbags.csv, the E: rows; lnk-files.csv, VolumeSerialNumber; partition-diagnostic.csv.
- Usual mistake
- Attributing every E: folder to the unapproved stick.
Q082 points
How many uploads to the personal cloud service upload.bulutkutu.example succeeded?
Answer38
On 8 September the client BulutKutuKurulum.exe is downloaded and the desktop client signs in. On 9 September between 09:30:05 and 09:57 UTC (lunch time locally) it sends 41 POST requests to upload.bulutkutu.example under the path /Poyraz/. 38 return 200; three large files (two drawings and a zip) return 413, refused by the service. The successful ones carry about 190 MB out.
- Where
- proxy-log.csv, method POST, target upload.bulutkutu.example, status.
- Usual mistake
- Counting all 41 requests, or counting the sync/state heartbeats.
Q092 points
When was the first successful upload to the personal cloud? UTC.
Answer2026-09-09 09:30:05
The first POST with status 200 is at 09:30:05 UTC on 9 September, 12:30 local: TRB-2026-Teklif-Fiyatlandirma.xlsx. ShellBags show the BulutKutu\Poyraz folder browsed from 09:22:16 to 09:29:50, the moment the files were placed in the synchronised folder.
- Where
- proxy-log.csv, first POST to upload.bulutkutu.example with status 200.
- Usual mistake
- Taking the installer download on 8 September or the sign-in.
Q102 points
How many pages did e.demir print on 14 September (UTC date)?
Answer212
Six PrintService 307 events for e.demir from ARGE-WS14 to ARGE-K2-MFP between 14:45:10 and 14:57:24 UTC (17:45 to 17:57 local): the customer contact list, two price analyses, the TRB-2026 offer and calculation report, the KMR-2025 offer and a supplier contract summary. 14+38+22+96+18+24 = 212 pages. The user had printed nothing else that day.
- Where
- print-log.csv, UserName e.demir, TimeCreated 2026-09-14, Pages.
- Usual mistake
- Counting documents (6) or summing every user's pages that day.
Q111 point
What does a PrintService 307 event let you say about the printed customer list?
AnswerB — That a document with that name was printed by that account from that computer on that printer, with its size and page count, and not what was on the pages or who took them.
Event 307 keeps metadata only. The document name is what the application passed to the spooler; a renamed file prints under its new name. Whether the pages left the building needs other evidence: badge records, cameras, a search.
- Where
- export-metadata.txt, Export 6.
- Usual mistake
- Writing that the list was handed over because it was printed.
Q122 points
A Remote Desktop logon (type 10) reaches the workstation on Sunday 13 September. When did the VPN session that carried it start? UTC.
Answer2026-09-13 19:10:41
The 4624 type 10 at 19:14:02 UTC comes from 10.99.3.41, a VPN pool address. In vpn-sessions.csv that tunnel address belongs to e.demir's session from 198.51.100.77 written 13.09.2026 22:10:41 to 14.09.2026 00:31:18 local. Subtract three hours: 19:10:41 to 21:31:18 UTC. The RDP session ends at 21:28:50.
- Where
- security-events.csv, EventId 4624, LogonType 10; vpn-sessions.csv, assigned_ip 10.99.3.41.
- Usual mistake
- Entering 22:10:41 as UTC: the VPN report is local time.
Q132 points
From which address did the Sunday Remote Desktop logon come?
Answer10.99.3.41
The 4624 event has LogonType 10 and IpAddress 10.99.3.41. Inside the company that is a tunnel address; the outside address is 198.51.100.77 in the VPN report, the same home address as the user's working-from-home sessions. ShellBags then show TRB-2026, KMR-2025, Musteri and Fiyat on the file share browsed between 19:22 and 19:47 UTC.
- Where
- security-events.csv, the LogonType 10 row.
- Usual mistake
- Entering the home address, which never reaches the workstation directly.
Q142 points
How many successful VPN sessions did e.demir start at a weekend or between 20:00 and 07:00 local time?
Answer2
The user's other sessions start between 08:29 and 08:58 local on Tuesdays and Thursdays and end by 18:00. Two do not: Saturday 05.09.2026 23:05:31 (1.2 GB to the client) and Sunday 13.09.2026 22:10:41 (4.4 GB to the client, the Remote Desktop session). Both are after the notice; the second is two days before the last day.
- Where
- vpn-sessions.csv, user e.demir, result OK, start_local.
- Usual mistake
- Applying the hours to the local times as if they were UTC, or counting the refused attempt on 16 September.
Q152 points
vpn-sessions.csv ends with 16.09.2026 10:02:44, e.demir, 203.0.113.140, FAIL, account disabled. What should the report say?
AnswerC — A connection was attempted with e.demir's credentials 15.5 hours after the account was disabled, from an address not seen before; it was refused and no session was established. Who made it is not shown.
The account was disabled at 18:30 local on 15 September (HR record); the attempt is at 10:02:44 local on 16 September from 203.0.113.140, not the home address 198.51.100.77. The control held. Report the attempt, the address and that no session followed; ask whether the user still holds a device with saved VPN settings.
- Where
- vpn-sessions.csv, last e.demir row; ik-kaydi.txt, Hesap kapatma.
- Usual mistake
- Writing an access that the log shows was refused.
Q162 points
Which sentence can the examiner sign?
AnswerC — Between 28 August and 14 September, under e.demir's account, copies of the customer contact list and project and price files were written to an unapproved stick (serial 4C530001050719102233), 38 files were uploaded to a personal cloud account and 212 pages were printed after hours; a Sunday VPN session carried a Remote Desktop logon and file share browsing. Where the copies went after that is not shown by these records.
Sentence c states what each record shows, under which account, with the identifiers a reader can check, and where the records stop. Sentence a names a recipient no file shows; b ignores the unapproved stick and the uploads; d turns a date into a motive. The account is not the person: the report says 'under e.demir's account', and the Security log ties the sessions to interactive logons on the workstation.
- Where
- All exports; README.txt, rule 4.
- Usual mistake
- Choosing d because the first copy precedes the notice.
03Reconstructed timeline
The timeline as the correct answers build it. Local time is UTC+3.
| UTC | Local | Event | Source |
|---|---|---|---|
| 16:38:12 | 19:38:12 | The unapproved SanDisk stick arrives after hours (19:38 local). | partition-diagnostic.csv |
| 16:44:51 | 19:44:51 | First copy on the stick: TRB-2026-Teklif-Fiyatlandirma.xlsx; the customer contact list follows at 17:03. | lnk-files.csv |
| 20:05:31 | 23:05:31 | Saturday night VPN session from home, 1.2 GB to the client (written 23:05:31 local). | vpn-sessions.csv |
| 10:03:40 | 13:03:40 | The personal cloud client is downloaded and signs in. | proxy-log.csv |
| 09:30:05 | 12:30:05 | First of 38 successful uploads to upload.bulutkutu.example. | proxy-log.csv |
| 15:02:05 | 18:02:05 | The SanDisk stick arrives again; KMR-2025 and price files are copied. | partition-diagnostic.csv |
| 19:14:02 | 22:14:02 | Remote Desktop logon from VPN address 10.99.3.41; file share folders browsed until 19:47. | security-events.csv |
| 14:45:10 | 17:45:10 | Six documents, 212 pages, printed after hours. | print-log.csv |
| 07:02:44 | 10:02:44 | Refused VPN attempt with the disabled account from 203.0.113.140 (written 10:02:44 local). | vpn-sessions.csv |
04Scoring
Questions 1–11 carry one point each and question 12 carries three: 30 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.
| Points | Next step |
|---|---|
| 27–30 | Sound. Move on to a supervised review of a real workstation image with its file server logs. |
| 15–26 | Review each missed question with its explanation, then rebuild the month in the workbench: devices first, then the timeline filtered on e.demir. |
| 0–14 | Work through VP-01 first, then repeat this pack with the workbench's device view open. |
Finding paragraph: criteria
- Every time carries its basis; the VPN report and the HR record are converted from local time.
- The stick is tied to files by volume serial number, and the approved stick's files are kept apart.
- Counts state their filter: successful uploads only, one user's pages on one date.
- Each channel is placed against the notice, the last day and the disabling of the account.
- The report says 'under the account', names no recipient and lists what was not examined.
05Debrief
- Departing-employee reviews start weeks before the notice: the first copy here is three and a half days earlier.
- A drive letter is a seat, not a device. Volume serial numbers and serial numbers are the names.
- Upload, print and VPN logs record that something left, how much and when; they never record who read it next.
- Disabling the account worked; the refused attempt the next morning is why the step matters.
06Model finding
Under the account e.demir, the workstation ARGE-WS14 received an unapproved SanDisk Ultra Fit stick (serial 4C530001050719102233, volume 7A3E-11C2) twice: on 28 August 2026 from 16:38:12 to 17:21:40 UTC (19:38 local, after hours) and on 11 September from 15:02:05 to 15:48:31 UTC (partition-diagnostic.csv). Eight shortcuts point to that volume; six are files whose creation time on the stick follows their modification time, the pattern of a copy: three TRB-2026 project files and the customer contact list on 28 August, a KMR-2025 offer and a 2026 unit price analysis on 11 September (lnk-files.csv). The first copy, at 16:44:51 UTC on 28 August, precedes the resignation notice (06:12:37 UTC on 1 September, ik-kaydi.txt) by about three and a half days. On 8 September a personal cloud client was installed; on 9 September from 09:30:05 UTC it sent 41 uploads under /Poyraz/ to upload.bulutkutu.example, of which 38 succeeded (about 190 MB) and 3 were refused as too large (proxy-log.csv). On 14 September from 14:45:10 to 14:57:24 UTC (17:45 local) six documents, 212 pages in all, including the customer contact list, were printed to ARGE-K2-MFP (print-log.csv). Two VPN sessions began outside working hours: Saturday 5 September 20:05:31 UTC and Sunday 13 September 19:10:41 UTC (written in local time in vpn-sessions.csv); the second carried a Remote Desktop logon to the workstation from 10.99.3.41 at 19:14:02 UTC, during which the file share's project, customer and price folders were browsed (security-events.csv, shellbags.csv). After the account was disabled (15:30 UTC on 15 September) a VPN attempt with it from 203.0.113.140 at 07:02:44 UTC on 16 September was refused. Limits: the records show copies, uploads, prints and remote sessions under the account; they do not show the contents of the stick, the cloud account or the printed pages, nor who received them. The file server's logs and the user's home computer were not examined.