01Session plan
| Minutes | Block | What happens |
|---|---|---|
| 0–10 | Brief and rules | Read the scenario aloud. State the three rules that decide most answers: integrity first, UTC throughout, accounts are not people. |
| 10–20 | Integrity and time base (Q1–Q2) | Everyone hashes the files and writes the result in an examination log. Settle the time zone together before anyone reads an event. |
| 20–45 | Session and device (Q3–Q7) | Pairs work through the event logs and the registry. Walk the room and ask for the file and row behind each answer. |
| 45–65 | Program and file (Q8–Q11) | Prefetch and LNK files. The E: trap in Q10 is the main teaching moment; let pairs fall into it before you discuss it. |
| 65–75 | Finding and confidence (Q12) | Each trainee writes one finding paragraph in their own words, then answers Q12. |
| 75–90 | Debrief | Build the timeline on the board from the trainees' answers and go through the debrief points below. |
Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →
02Answer key
Q011 point
Compute the SHA-256 of prefetch.csv and compare it with manifest.txt. Enter the first eight hexadecimal characters.
Answer43689920
The value begins 43689920 and matches the manifest. The point is the habit: hash every received file before reading it and record the result in the examination log. A mismatch is recorded and reported, never quietly corrected.
- Where
- manifest.txt, the prefetch.csv line; recompute with the hash tool or sha256sum.
- Usual mistake
- Hashing a copy that a spreadsheet program has opened and re-saved: the line endings change and so does the hash.
Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration
Q021 point
What was the workstation's offset from UTC on 14 March 2026?
AnswerC — UTC+3
TimeZoneInformation holds Bias −180 and the key name Turkey Standard Time. Windows defines UTC = local time + Bias (in minutes), so local time is UTC + 3 hours. Turkey has kept a fixed UTC+3 since 2016, so no daylight-saving change applies in March.
- Where
- registry-excerpt.txt, [ControlSet001\Control\TimeZoneInformation].
- Usual mistake
- Reading −180 as UTC−3. The sign of Bias is the opposite of the usual ±offset notation.
Q031 point
When did the first successful interactive logon on Saturday 14 March take place? Give the time in UTC.
Answer2026-03-14 06:41:07 UTC
Security 4624 with logon type 2 for d.aydin at 06:41:07 UTC (09:41:07 local), logon ID 0x3E7A1F2. The 4624 entries at 06:38:41 are type 5 service logons by SYSTEM, LOCAL SERVICE and NETWORK SERVICE that every boot produces; the 4625 at 06:40:51 is a failure.
- Where
- security-events.csv, the 4624 row with LogonType 2 on 2026-03-14.
- Usual mistake
- Taking the first 4624 of the day (06:38:41, type 5), or giving local time without an offset.
Q041 point
Sixteen seconds before that logon there is a 4625 for the same account with sub-status 0xC000006A. What does it support?
AnswerB — A wrong password was entered once for d.aydin, then the right one; on its own this does not point to another person.
0xC000006A means the user name was valid and the password wrong. One failure followed by success at the same console (type 2, source 127.0.0.1) is the ordinary pattern of a mistyped password. Record it; it says nothing about who typed. There is no lockout event (4740), and type 2 from 127.0.0.1 is local, not remote.
- Where
- security-events.csv, the 4625 row at 06:40:51.
- Usual mistake
- Reading a single failed logon as an intrusion attempt.
Q051 point
Which removable storage device was connected on Saturday? Enter its serial number.
Answer60A44C3FAE3BF2A1B9C0
Partition/Diagnostic 1006 at 06:58:44 UTC records a Kingston DataTraveler 3.0 with serial 60A44C3FAE3BF2A1B9C0, and the USBSTOR last-arrival property (0066) gives the same second. The SanDisk was last connected on Friday 13 March. The &0 suffix in the USBSTOR key is Windows' instance number, not part of the serial.
- Where
- partition-diagnostic.csv, the 1006 row at 2026-03-14 06:58:44; registry-excerpt.txt, USBSTOR.
- Usual mistake
- Picking the SanDisk because it also appears as E:.
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
Q061 point
Was Saturday the first time this device was connected to PAY-WS03?
AnswerB — No: the registry records a first install on 3 November 2025.
USBSTOR property 0064 (first install) is 2025-11-03 13:05:11 UTC. The Partition/Diagnostic excerpt begins on 2 March 2026, so its silence about earlier dates is a retention limit, not a negative finding. The shortcut yedek.lnk, created 2025-11-03 13:07:02 for E:\yedek on volume 4A1C-90E2, agrees.
- Where
- registry-excerpt.txt, Kingston USBSTOR property 0064; lnk-files.csv, yedek.lnk.
- Usual mistake
- Treating the absence of an entry in a log with limited retention as proof that nothing happened.
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)LNK shortcut files
Q071 point
Which record ties the Kingston volume to the d.aydin user profile, rather than only to the computer?
AnswerB — The MountPoints2 key in d.aydin's NTUSER.DAT
SYSTEM and the event logs are machine-wide: they place the device on the computer. MountPoints2 lives in the user's own hive. The key for volume {6c1f0d2e…}, which MountedDevices maps to the Kingston, was last written at 06:58:46 UTC, two seconds after arrival, while d.aydin was logged on; t.kaya's hive has no entry for it. The LNK files in d.aydin's Recent folder point the same way.
- Where
- registry-excerpt.txt, NTUSER.DAT of d.aydin, MountPoints2; MountedDevices for the volume GUID.
- Usual mistake
- Choosing USBSTOR: it identifies the device but not the user profile.
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
Q081 point
According to prefetch, how many times has 7ZG.EXE run on this workstation?
Answer2
RunCount 2: last run 07:22:15 UTC, previous run 07:19:48 UTC. 7ZG.EXE is the 7-Zip component behind Add to archive; 7ZFM.EXE, the file manager, ran once at 07:18:02. Prefetch times are written a few seconds after a program starts, so allow about ten seconds. 7-Zip was installed on 1 December 2025 (7Z2409-X64.EXE), long before Saturday.
- Where
- prefetch.csv, the 7ZG.EXE row.
- Usual mistake
- Reporting the run count of the installer or of 7ZFM.EXE.
Q091 point
What is the full path of the archive created on Saturday?
AnswerE:\yedek\bordro-2026-Q1.7z
bordro-2026-Q1.7z.lnk points to E:\yedek\bordro-2026-Q1.7z: target created 07:19:52 UTC and modified 07:22:38 UTC, matching the two 7ZG.EXE runs. The prefetch entry for 7ZG.EXE references \YEDEK\BORDRO-2026-Q1.7Z on the volume with serial 4A1C-90E2.
- Where
- lnk-files.csv, the bordro-2026-Q1.7z.lnk row, LocalPath.
- Usual mistake
- Giving the path of the payroll workbook on C: instead of the archive.
Q101 point
The archive's path begins with E:. Which value shows that it was on the Kingston and not on the SanDisk?
AnswerB — The volume serial number 4A1C-90E2
Both devices received E: on different days: ekip-listesi.xlsx on Friday is also on E:\, on volume 1E07-5B3C. The volume serial in the LNK (4A1C-90E2) matches the serial Partition/Diagnostic read from the Kingston's boot sector at 06:58:44 and the volume in the 7ZG.EXE prefetch entry. Drive letters are reassigned and a label is a name anyone can change.
- Where
- lnk-files.csv VolumeSerialNumber; partition-diagnostic.csv VbrVolumeSerial; prefetch.csv Volumes.
- Usual mistake
- Relying on the drive letter or the label.
LNK shortcut filesUSB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
Q111 point
When was the Kingston last removed? Give the time in UTC.
Answer2026-03-14 07:31:02 UTC
USBSTOR property 0067 and the 1006 removal entry (capacity 0) agree on 07:31:02 UTC (10:31:02 local): about eight minutes after the archive was last modified and four minutes before the workstation was locked at 07:35:10.
- Where
- registry-excerpt.txt, Kingston USBSTOR property 0067; partition-diagnostic.csv, the capacity-0 row.
- Usual mistake
- Giving the shutdown time, or 10:31:02 without an offset.
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
Q123 points
Which statement could you sign as a finding, with the right confidence?
AnswerB — While the account d.aydin was logged on interactively, an archive named bordro-2026-Q1.7z was created with 7-Zip on a volume of the Kingston device (serial 60A44C3FAE3BF2A1B9C0). Established. These records do not show which person used the account.
Statement b stays with what independent records agree on: the logon session (4624, 4647), program execution (prefetch), a file on a specific volume (LNK volume serial and the 1006 boot-sector serial) and the device's identity (USBSTOR, MountPoints2). (a) attributes to a person what the records attribute to an account. (c) goes past the evidence: the archive's name and the workbook in 7ZG.EXE's loaded files make it probable, but the archive itself was not examined. (d) is too cautious: parser output is a legitimate working copy when the tool and version are recorded; it is a limit to state, not a reason to stop.
- Where
- All files; see the timeline below.
- Usual mistake
- Choosing (a): the most common error in real reports.
03Reconstructed timeline
Saturday 14 March 2026, as the correct answers build it. Local time is UTC+3.
| UTC | Local | Event | Source |
|---|---|---|---|
| 06:38:12 | 09:38:12 | Operating system started (System 12) | system-events.csv |
| 06:40:51 | 09:40:51 | Failed logon for d.aydin, wrong password (4625, 0xC000006A) | security-events.csv |
| 06:41:07 | 09:41:07 | Interactive logon d.aydin, logon ID 0x3E7A1F2 (4624, type 2) | security-events.csv |
| 06:58:44 | 09:58:44 | Kingston DataTraveler 3.0 connected, volume serial 4A1C-90E2 (1006; USBSTOR 0066) | partition-diagnostic.csv |
| 06:58:46 | 09:58:46 | MountPoints2 key for the Kingston volume written in d.aydin's hive | registry-excerpt.txt |
| 07:03:30 | 10:03:30 | EXCEL.EXE last run; bordro-2026-Q1.xlsx opened (LNK target accessed) | prefetch.csv |
| 07:18:02 | 10:18:02 | 7ZFM.EXE (7-Zip file manager) run, only run ever | prefetch.csv |
| 07:19:48 | 10:19:48 | 7ZG.EXE first run; E:\yedek\bordro-2026-Q1.7z created at 07:19:52 | prefetch.csv |
| 07:22:15 | 10:22:15 | 7ZG.EXE second run; archive modified at 07:22:38 | prefetch.csv |
| 07:22:40 | 10:22:40 | bordro-2026-Q1.7z.lnk created in d.aydin's Recent folder (archive opened) | lnk-files.csv |
| 07:31:02 | 10:31:02 | Kingston removed (1006 capacity 0; USBSTOR 0067) | partition-diagnostic.csv |
| 07:35:10 | 10:35:10 | Workstation locked (4800); unlocked 07:39:52 (4801) | security-events.csv |
| 07:44:05 | 10:44:05 | Logoff d.aydin (4647); shutdown initiated 07:44:20 (System 1074) | security-events.csv |
04Scoring
Questions 1–11 carry one point each and question 12 carries three: 14 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.
| Points | Next step |
|---|---|
| 12–14 | Sound. Move on to the next pack or to a supervised review of a real report. |
| 8–11 | Review every missed question with its explanation and the linked library record, then retry those questions. |
| 0–7 | Work through the curriculum modules on time and on Windows artifacts first, then repeat the pack. |
Finding paragraph: criteria
- ☐ Every time is in UTC, or carries its offset.
- ☐ The paragraph names the account, not a person, as the actor.
- ☐ Each claim names the record that supports it.
- ☐ The limits are stated: archive content not examined; the person behind the account not shown.
05Debrief
- Integrity comes before reading. A hash checked after analysis protects nothing.
- Bias −180 means UTC+3. Write UTC with local time in brackets, never local time alone.
- Drive letters are reassigned. Device serials and volume serials carry identity.
- Absence of an entry in a rotated log is not evidence that nothing happened.
- Records attribute actions to accounts; content you have not examined is not a finding.
06Model finding
Between 06:41:07 and 07:44:05 UTC on 14 March 2026 (09:41–10:44 local), the account KESTREL\d.aydin held an interactive session on PAY-WS03 (Security 4624 type 2, 4647). During that session a Kingston DataTraveler 3.0, serial 60A44C3FAE3BF2A1B9C0, was connected at 06:58:44 and removed at 07:31:02 (Partition/Diagnostic 1006; USBSTOR 0066/0067), and its volume, serial 4A1C-90E2, was mounted in d.aydin's profile (MountPoints2). 7-Zip's 7ZG.EXE ran at 07:19:48 and 07:22:15 (prefetch), and a file E:\yedek\bordro-2026-Q1.7z on volume 4A1C-90E2 was created at 07:19:52 and modified at 07:22:38 (LNK). We state these as established. The archive itself was not available, so its content is not stated; that it holds the Q1 payroll workbook is probable, given its name and the workbook among the files 7ZG.EXE loaded. The records attribute this activity to the account; they do not show which person used it.