CIS 4684 Lab 3.docx - Lab 3: Forensic Analysis of a Window...

Lab 3: Forensic Analysis of a Window 10 Client
Loading the disk from the compromised machine
I. Can you add a physical disk to Autopsy?
II. What other choice are there besides adding a physical disk to Autopsy? III. What are some of the commercial forensic tools mentioned in this
section?
IV. What icon is used to launch the Autopsy Program?
Analyzing common locations of compromise artifacts
I. Where can you check to see if a file is malicious?
a. Event viewer files
b. Registry files
c. Startup folder
d. Path
e. Scheduled tasks folder
II. What are some of important registry you should extract? III. What are some of the important event viewer files that you should extract?