Digital Forensics: Final Exam | Scan the suspect data and answer questions using Autopsy tool

Suspect “John Doe” has allegedly been hacking public and private websites. We believe he has an accomplice that he may be meeting soon.

After getting a search warrant, first responders collected network traffic and a RAM image of the suspect’s live system. Technicians at the lab collected an offline disk image.

All collected suspect data can be downloaded from the college website. Username, Password & files navigation path will be provided in the private chat to download the below files for analyzing.

There are three images:

• Windows 10 disk image (15GB)
• Windows 10 RAM image (4.5GB)
• Network traffic acquisition (32MB)

The investigating member is asking the following questions:

• Is there any evidence of website hacking?
• Is there any evidence of a planned meeting? If so, when and where?
• Please provide any user passwords for further analysis.

Remember, proper documentation and reporting are very important! Good luck!