Digital Forensics Challenge Treasure Hunt - Round 1

The first round of the Digital Forensics Challenge is now available! This challenge, written by Rob Lee of the SANS Digital Forensics Team, requires participants to analyze a screen capture of the files on a disk to answer questions. To participate, click the Question Engine link to the left, register, and make sure you enroll in the Digital Forensics Challenge Treasure Hunt - Round 1 quiz. If you don't close your browser between registering and clicking the link in the confirmation e-mail, it should remember which course you are enrolling in.


The plans to a secret weapon were found on a USB Key in a parking lot outside a military installation that uses only default installations of Windows 7. During initial examination of the files on the USB key, the investigator had some questions that they were hoping that you might be able to answer. The investigator provided a screen capture of the files and the modified, accessed, and created times of the files on the USB Key. Using only the screen capture as evidence, please answer the questions.

HINT: Default installations of Windows 7 will have the last access time disabled.

Screenshot of File Information