Question

Please answer the following question according to the Image.

1. What directories and type of files exist in systemprofile?

2. How can the various types of files content assist in your investigation of the M57-Jean case? Be specific on content in at least “Application Data”, Cookies, and one (1) additional, systemprofile subdirectories. Artifacts are stored on a system based on what commands users run and where they decide to store certain files. Users are often not aware of clues their actions leave on a Windows system for investigators performing examinations. Change directory to Documents and Settings specifically for Jean.

cd /mnt/windows_mount/”Documents and Settings”/Jean ls

3. How can the various types of files content assist in your investigation of the M57-Jean case? Be specific on content in at least “Application Data”, Cookies, “My Documents”, “UserData“, and two (2) additional, ”Documents and Settings”/Jean subdirectories, but not Recent since you will look there in task 3.

Terminal ® - Terminal File Edit View Search Terminal Help Terminal wins: root@siftworkstation -> /m/w/W/system32 Windows-to-Unix # cd config rensics- Cheatsheet.pdf root@siftworkstation- /m/w/w/s/config # ls Forensics-Poster AppEvent. Evt SAM pdiSECURITY.LOG SusEvent. Evt default SAM. LOG software default.LOG SecEvent. Evt software. LOG system-LOG default. save SECURITY software savch system profile root@siftworkstation -> /m/w/w/s/config system. sav. Tempkey. LOG userdiff userdiff. LOG Pasterna Windows

Answer 1

Answer 1
**********
Its related to system and users where installed software data and desktop icon stored cookies and printer and user favorites and documents are stored which is used by system as well.

Answer 2
**********
Start menu application data ,NTUSER.dat file is a log file that comprise the user's, setting, configuration, and preference and recently opened application.

Answer 3
**********
Document and settings are related to user data where shortcuts and recent files which are opened last.

if you have any doubt then please ask me without any hesitation in the comment section below , if you like my answer then please thumbs up for the answer , before giving thumbs down please discuss the question it may possible that we may understand the question different way and we can edit and change the answers if you argue, thanks :)