Digital Forensics Basics 1.3 impossible answer

It wants me to find an email address associated with a deleted downloaded file but there is no prior instruction or mention of this sort of thing

1 Like

Welcome to forums @RelevantHummingbird1648 !!

In Step 36 of the Guided Exercise you are asked to look at $R5To154.csv. This is deleted file which we suspect is Salaries.csv after it was deleted from the Recycle bin. If you focus on $R5To154.csv you will be able to solve the challenge.

I got the salary out of there but I can’t find anything referencing an email address in that file or the ones around it, it’s very strange

Good point. The original question talks about web history. Yet the question in production does not mention this. Let me fire up the lab.

I’m going to see about reverting the questions back to the original. But for now, here are the original questions. Let me know if they help…

Questions:

1.) Is there a deleted file called $R5T0I54.csv? (Yes or No)

2.) What is the Gross Salary of Tommy Francis? (Hint: look in other tabs, not just Data Artifacts)

3.) Look at the Web History for this Case. There are 24 entries. What was the name of the Google Mail account used to download Salaries.csv?

There was a Lot More information I wasn’t seeing because I didn’t scroll to the left in the Listing window, I got it now. Thank you!

1 Like