Let's Investigate: Hydra's Heads
Channel: A Fascinating Chap
Date: 2022-08-24

This scenario takes place circa 2012.
Three months ago, Tandy Miller disappeared from his post at S.H.I.E.L.D. at around 0800 on April 3rd. However, Nick Fury has reason to believe that Tandy has been using a generic account, “vibranium” to access confidential or proprietary data after his disappearance. They already have evidence that points to him using the account, but they need to confirm he has accessed the sensitive data. Use the provided NTUSER.DAT file to examine the user’s registry hive to answer the following questions.

Your job in this scenario:
Your objective is to produce a competent forensic report on your examination of the evidence, regardless of whether you’re able to locate any incriminating evidence. Document your investigation fully. In each response be sure to include the hive in which you found your answer. In your report, answer the following questions:
1. What is the most recent keyword vibranium searched for?
2. What is the most recent typed URL and when was it accessed?
3. What is the most recently opened FILE and when was it accessed?
4. What is the most recently opened FOLDER and when was it accessed?
5. What is the most recently opened JPG file and when was it accessed?
6. How many times has the program solitare.exe been run by this user, and when was it last run?
7. What is the make and model of the printer (redirected 3) hooked to this system?
8. Given ONLY the information in this NTUSER.DAT, what are the indications Tandy is behind this? Are there indications he is not? Can we be certain?