I’m almost certain I’m staring at the correct answer to the question - ‘According to BAM records, what is the execution time for the file “FTK Imager.exe”’, but it is not being accepted. I opened the cleaned SYSTEM hive in Registry Explorer, navigated to the 'bam/UserSettings/S-1[…]-500
’ directory and found the Program and Execution Time, but it is not being accepted in the lab exercise. Can someone confirm if this is the right answer or not?
Same problem here , any help please ?
Yeah, that looks correct. I’ve preemptively updated the answer key and I’ll follow up with the instructor to confirm.