ForenSim - Case FS-001: The Deleted Assignment

FS

ForenSim

Browser forensics lab - demo build 0.1

CASE FS-001 AUTO-GRADED LAB

Synthetic evidence only.
No real data leaves this page.

Case briefing

A university lab computer was used the evening before the mid-semester exam. The instructor reports that the master assignment file and an answer key went missing from the shared drive. A forensic image of the machine has been acquired.

Work the case: verify the evidence, recover what was deleted, carve hidden data from unallocated space, build the timeline, and file your findings.

Tasks

Score

0/100

Start with the Acquisition tool.