Digital Forensics-Windows Registry Analysis 1.3 Challenge Exercise solution not working

Career Paths Security Engineer
1

Hi all!
Are any of you also having problems solving the lab? Up until this challenge, everything was easy to solve. The solution for this one just doesn’t seem to work, although I’m pretty sure I’ve found the right answers since the challenge isn’t really very complicated…
Thanks,
BR Chris

2

Can you message me your answers? I can compare them against the answer key and let you know which ones are incorrect.

3

Q1: ControlSet001 (should be correct according task-tab / submit)
Q2: 2019-12-07 09:15:07 (displayed as incorrect)
Q3: DESKTOP-7BU6SKC (displayed as incorrect)
Q4: 420 (displayed as incorrect)
Thanks!

4

Okay, so while there is a set of Hive files in the Analysis folder marked Challenge, the instructions say Welcome to the Challenge Exercise! For this challenge, you will use the Registry Explorer to answer questions about the SYSTEM file that you cleaned in Part 5 of the previous lesson.

So the system is expecting answers from the Guided SYSTEM hive. It looks like your answers are from the Challenge SYSTEM hive. I’ll have to check with the instructor, but my guess is the Challenge SYSTEM hive is a residual development artifact that ultimately wasn’t used - or may be used in a standalone Challenge that shares the same lab image.

1 Like
5

Thanks for the hint. Although it’s a Challenge Exercise you have to use the files from the guided folder and not as it would be obvious from the Challenge folder…
Thanks
Chris

6

Yup, I agree that the Challenge folder is misleading. I’m looking into this with the instructor. Assuming that file isn’t used elsewhere, I’m inclined to update the Challenge to actually use the Challenge files.