Magnet User Summit DFIR CTF 2019-Activity


This is a part ties into the MUS-CTF-19-DESKTOP-001.E01 evidence file provided.

Sharepoint 1 5

How many files were downloaded from the magnetic4nsics Sharepoint?

Sharepoint 2 5

Whats the name of the archive that was retrieved from the sharepoint?

Notify 5

On March 18th 2019 at 18:58:21 Selma saw a Windows popup notification. What type of notification was it?

Sharepoint 4 5

Which was retrieved from the sharepoint first?

Remote 5

At 6:35PM on the 18th of March, Selma logged into her account on the Desktop. What method of did she use to access the Desktop?

Host Name 5

What was the host name of the machine Selma used to remote into the Desktop at 6:35PM on the 18th of March?

Unique Access 5

How many unique machines accessed the Desktop via TeamViewer?

Sharepoint 3 10

What is the volume serial number of the volume the sharepoint archive was placed on (format: decimal number)?

Notify 2 10

Again, on the 18th of March at 18:08:57, another notification was given. What did this notification say?

Bytes Sent 10

How many bytes total were sent out on the network via the Team Viewer Service?



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store