ForensicsMedium

Insider Threat Disk Analysis

forensicswindowsregistry

UNG Cybersecurity Faculty

1/15/2025

275 points

Challenge Files

Challenge Instructions

README.txt

💡 Tip: Additional challenge-specific files are located in the assets folder. Check the instructions file for details.

Challenge Overview

Investigate a seized laptop from a suspected insider threat. Perform disk forensics to recover deleted files, analyze Windows Registry for persistence mechanisms, and extract evidence of data theft.

Learning Objectives

Apply forensics analysis techniques
Use professional security tools
Understand real-world attack scenarios
Document findings professionally

Tools You May Need

Autopsy or FTK Imager
Registry Explorer
Windows forensics toolkit

Getting Started

Review the challenge description carefully
Gather and examine all provided materials
Apply systematic analysis methodology
Document your findings as you progress
Submit the flag when discovered

Flag Format

All flags follow the format: ung{descriptive_text}

Good luck!

Hints

💡 Hint 1 (Click to reveal)

Start by examining the basic artifacts and evidence provided

💡 Hint 2 (Click to reveal)

Use industry-standard tools for this type of analysis

💡 Hint 3 (Click to reveal)

The flag follows the format ung{...} with descriptive text