I’m almost certain I’m staring at the correct answer to the question - ‘According to BAM records, what is the execution time for the file “FTK Imager.exe”’, but it is not being accepted. I opened the cleaned SYSTEM hive in Registry Explorer, navigated to the 'bam/UserSettings/S-1[…]-500
’ directory and found the Program and Execution Time, but it is not being accepted in the lab exercise. Can someone confirm if this is the right answer or not?
