Operation Second Hand

FORENSICS · WINDOWS · difficulty 5 · ~50 min · 18 steps

Every timestamp on the suspect file says March. The filesystem keeps a second set that nothing bothered to change.

Briefing

A contractor's workstation, collected after a data-theft allegation. The tool in question sits in a program directory with a creation date of 11 March — three weeks before the contractor started, which is the entire basis of their position that it was already there. The security log has a gap. The executable's timestamps are internally consistent and support the claim. There is no anti-forensics tool on the disk and no obvious tampering anywhere. Windows keeps records of execution in four places that have nothing to do with the file's own metadata, and the master file table keeps two sets of timestamps where most people only know about one.

Objectives

• Parse the master file table and locate the file's record
• Compare the two timestamp sets the record holds
• Prove execution from artefacts the file itself does not control
• Establish what the log gap is and when it was made
• Build a defensible sequence out of independent sources

Return to the range lobby