Hey Digital Forensics folks, this challenge is hardcoded like Ali Hadi’s cases, which this is one of the challenges in 13Cubed — Investigation Windows Endpoint course, and the files are only shared with students. So, I can’t share the files here with you guys. A big thank for Richard Davis allowing me to post my documentation process on Medium blog.

Scenario :

Lola has just started a new job at ACME Corp, and a colleague is helping with getting her up and running.

Things have been going smoothly so far, she has her new workstation and is logging in happily, and her colleague has been showing her different ways ACME employees can share tools amongst each other. She grabs one of the tools he mentioned was particularly useful from the CommonTools share, copies it to her Desktop, and starts making use of it — she has encountered some strange behavior in its functionality though.

Her colleague assures her that this behavior is nothing to worry about, but she submits a support ticket to helpdesk to investigate anyways, just in case she’s missed something in her set-up process.

Turns out, this particular tool has triggered some security alerting, and you have been called in to investigate what happened following its execution on Lola’s workstation — a memory capture and disk image have been collected for analysis.