Magnet User Summit DFIR CTF 2019-Activity

Activity

This is a part ties into the MUS-CTF-19-DESKTOP-001.E01 evidence file provided.

Sharepoint 1 5

How many files were downloaded from the magnetic4nsics Sharepoint?

Sharepoint 2 5

Whats the name of the archive that was retrieved from the sharepoint?

Notify 5

On March 18th 2019 at 18:58:21 Selma saw a Windows popup notification. What type of notification was it?

Sharepoint 4 5

Which was retrieved from the sharepoint first?

Remote 5

At 6:35PM on the 18th of March, Selma logged into her account on the Desktop. What method of did she use to access the Desktop?

Host Name 5

What was the host name of the machine Selma used to remote into the Desktop at 6:35PM on the 18th of March?

Unique Access 5

How many unique machines accessed the Desktop via TeamViewer?

Sharepoint 3 10

What is the volume serial number of the volume the sharepoint archive was placed on (format: decimal number)?

Notify 2 10

Again, on the 18th of March at 18:08:57, another notification was given. What did this notification say?

Bytes Sent 10

How many bytes total were sent out on the network via the Team Viewer Service?

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store