Hello,
I’m having problem to solve the IR challenge.
After many tries, I have finally got the pagefile.sys with his correct size.
But for C size, after many tentatives, I can’t find the solution
could you kindly help me please?
thank you
all the best
The answer they are looking for is smaller. I will take a look at this tomorrow and see if there is an issue.
Are you by chance saving the FTK memory dump and pagefile to the BILLPC2 folder as well as the Kape forensic data? That might explain why you are seeing so much more data in BILLPC2. I have altered the Challenge instructions to make them more clear.
I am also changing the question to multiple choice as I have seen that the actual size of the triage differs every single time (but always within a certain size range).
thank you Joseph!
All the best
