: Tools like Autopsy , FTK Imager , or EnCase used to browse the image. Artifact Recovery : List specific artifacts examined:

: Identify which user account was used and what files they accessed. 5. Conclusion & Recommendations

: Checking for login/logout times and service failures.

: (You must calculate these using tools like CertUtil -hashfile or sha256sum ) MD5 : [Insert MD5] SHA-256 : [Insert SHA-256]

Summarize the "who, what, when, where, and how" of the incident.

: Highlight the most critical evidence found (e.g., specific malware, exfiltrated files, or unauthorized logins). 2. Evidence Information File Name : IP_Leandro_Set5.rar

: Looking for recent software execution or user activity.

Ip_leandro_set5.rar -

: Tools like Autopsy , FTK Imager , or EnCase used to browse the image. Artifact Recovery : List specific artifacts examined:

: Identify which user account was used and what files they accessed. 5. Conclusion & Recommendations IP_Leandro_Set5.rar

: Checking for login/logout times and service failures. : Tools like Autopsy , FTK Imager ,

: (You must calculate these using tools like CertUtil -hashfile or sha256sum ) MD5 : [Insert MD5] SHA-256 : [Insert SHA-256] : Tools like Autopsy

Summarize the "who, what, when, where, and how" of the incident.

: Highlight the most critical evidence found (e.g., specific malware, exfiltrated files, or unauthorized logins). 2. Evidence Information File Name : IP_Leandro_Set5.rar

: Looking for recent software execution or user activity.