Lab4usb10a001 winhex lost directories used the find

and found to include a password that was used to decrypt files.
Lab4_USB10a.001 – WinHex - Lost Directories
 Used the “Find Text” search function to look for “..” which indicates a
sub-directory.
 Upon discovery of a valid sub-directory, records are decoded using
WinHex’s template manager function.
 Time stamps for files were recorded and an anomaly was discovered
with one file. One file was created a year earlier than the rest of the
files.
Lab4_USB10a.001 – WinHex - Lost Directories
 Files found in the Instructor directory were inspected and attempts
were made to correlate files if the offset of files matched.
 Discoveries included files with mismatched extensions, changing these
extensions allowed for further examination of containing information.
 These files were exported to the case folder for later use
Conclusion:
After thorough analysis of data found on the evidence items, we can answer the following
questions:
Page 2 of 4

 What information has been hidden in this reference image?