This was an interesting experiment of a challenge. We left a lot of things to find in this image and tomorrow I’ll will do a walk through of the artifacts. Today though its time to announce our anonymous winner!
The file ” Acme 2013 Budget.rtf” was likely transferred to the E: drive at approximately 00:53:48 UTC on 08/31/2013.
This is supported by the existence of a LNK file referencing access to E: Acme 2013 Budget.rtf. The embedded FILETIME object referencing the creation date of the LNK file target is 08/31/2013 00:53:48 UTC, indicating that Acme 2013 Budget.rtf was created on the E: drive at that time.
Access to this file on the E: drive is further corroborated through jump list entries and records in index.dat databases.
The file “Acme.zip” was likely burned to an optical disc at approximately 22:22:42 UTC on 09/03/2013.
This is supported by a reference to “Acme.zip” in the UsersSuspectAppDataLocalMicrosoftWindowsBurnBurn directory, which was identified by analysis of the USN journal. Specifically, the creation and subsequent deletion of Acme.zip in the directory with MFT record number 15992, which corresponds to the Burn directory, was identified in records 11674688 and 11674848, respectively, of the USN journal.
Acme.zip appears to have contained “Information for Patent.rtf” and “Prototype.bmp”.
Based on event log analysis, the USB device connected to the machine at the time “Acme 2013 Budget.rtf” was created on the E: drive was the VBTM Store ‘n’ Go USB Device with S/N: 0AC1F7605250196A.
Event log analysis further supports that “Acme.zip” was burned to an optical disc and indicates that the disc burning process may have taken place around 22:27:59 UTC (so the approximation of 22:22:42 UTC is still accurate).
This was a fun challenge for us to make, tomorrow I will be putting up the full solution and the image corresponds to chapter 13 of the new book. I’ll be linking the image and the solution document to the new book site, www.leardfir.com and we will be making videos showing how to find all these artifacts on our youtube channel in the near future!