ZEKASTRA

VP-01 · Computer and disk forensics

Windows triage: the payroll workstation on a Saturday

Seven files from a triage collection of a Windows 11 workstation: event logs, Partition/Diagnostic, prefetch, LNK files and registry excerpts. Twelve questions lead from file integrity and time base to a finding you could sign.

Synthetic training data. The organisation, people, devices, serial numbers and times are invented.

01Brief

Kestrel Logistics closes its office at weekends. Its payroll workstation, PAY-WS03, runs Windows 11 and is joined to the company domain. The payroll specialist's account is d.aydin. On Monday 16 March 2026 an IT technician (account t.kaya) took a triage collection from the workstation, hashed it and handed it to you with a request from internal audit.

Internal audit asks:

  1. Was PAY-WS03 used on Saturday 14 March 2026, and if so, when?
  2. Under which account?
  3. Did payroll data leave the workstation on removable storage?

You have the parser output of the collection, not the raw artifacts, and no access to the workstation, the network logs or the USB devices. Write every time in UTC; add local time in brackets where it helps the reader.

02Evidence files

FileContentsSHA-256
README.txtScenario and file listThe brief in English and Turkish and what each file is.1c166e8abe591dabd4152879d779caff95ea2f0f559f4992ab600ca2af719d9e
security-events.csvSecurity event logLogon, logoff, lock and unlock events from 13 to 16 March. Windows XML Event Log (EVTX) →032b9aba7c9f15abf59a2f90bfdc875bed1a6bdd15e11204ab2a823e50f4b89d
system-events.csvSystem event logBoots, shutdowns and the event log service. Windows XML Event Log (EVTX) →78e12855f708c2a2fbafdae7ee1af7d8b3f9009bd6bf3fc56bb4b9efea7dd09b
partition-diagnostic.csvPartition/Diagnostic 1006Storage device arrivals and removals with serial number and the volume serial read from the boot sector. USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log) →80bdf633970e3e39871774c9d43aa9bf718707052dc1dbb0d01224089de8e8c5
prefetch.csvPrefetchRun counts, last run times, volumes and an excerpt of the files each program loaded. Prefetch files →43689920491fa4166a5f4217aca1d7b0f922786395e2c99d4e9d59df2d27b2b2
lnk-files.csvLNK filesShortcuts from d.aydin's Recent folder with target times, drive type, volume serial and label. LNK shortcut files →cd3751afc912ac3aad4f9a4991c1e37c9cd6e2e17781dbda71b0e982c72ae479
registry-excerpt.txtRegistry excerptsTime zone, USBSTOR, MountedDevices, Portable Devices and MountPoints2. USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log) →39b88985607648efac68d38b0f5b1c3818255f5ed618bac5e34b6b0e4da00155
manifest.txtHash manifestSHA-256 of every file above. Verify before you start.(the manifest itself)

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

03Before you start

  • Verify every file against manifest.txt and write the result in your examination log before you read anything else.
  • Work on copies. A spreadsheet program that re-saves a CSV changes its hash.
  • Every time in the files is UTC. Establish the workstation's time zone before you translate anything into local time.
  • Records attribute actions to accounts and devices, not to people. Keep the two apart in every answer.
  • Note which file and which row supports each answer; the instructor will ask.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 12 questions, 14 points.

  1. Q011 pointprefetch.csvmanifest.txt

    8 hex characters, e.g. 1a2b3c4d

  2. Q021 pointregistry-excerpt.txt

    What was the workstation's offset from UTC on 14 March 2026?

  3. Q031 pointsecurity-events.csv

    UTC to the second, e.g. 2026-03-14 06:00:00Z (an offset such as +03:00 is converted)

  4. Q041 pointsecurity-events.csv

    Sixteen seconds before that logon there is a 4625 for the same account with sub-status 0xC000006A. What does it support?

  5. Q051 pointpartition-diagnostic.csvregistry-excerpt.txt

    Serial number as recorded

  6. Q061 pointregistry-excerpt.txtpartition-diagnostic.csvlnk-files.csv

    Was Saturday the first time this device was connected to PAY-WS03?

  7. Q071 pointregistry-excerpt.txt

    Which record ties the Kingston volume to the d.aydin user profile, rather than only to the computer?

  8. Q081 pointprefetch.csv

    A whole number

  9. Q091 pointlnk-files.csvprefetch.csv

    A Windows path, e.g. X:\folder\file.ext

  10. Q101 pointlnk-files.csvpartition-diagnostic.csvprefetch.csv

    The archive's path begins with E:. Which value shows that it was on the Kingston and not on the SanDisk?

  11. Q111 pointregistry-excerpt.txtpartition-diagnostic.csv

    UTC to the second, e.g. 2026-03-14 06:00:00Z

  12. Q123 points

    Which statement could you sign as a finding, with the right confidence?

Score 0 / 14

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

  • Every time is in UTC, or carries its offset.
  • The paragraph names the account, not a person, as the actor.
  • Each claim names the record that supports it.
  • The limits are stated: archive content not examined; the person behind the account not shown.

How findings are phrased →