Browser LabLD-DFIR-LAB-003Medium
Browser LabLD-DFIR-LAB-003Medium28 min
The Accusation That Failed
HR believes a departing Wadi employee, n.rashid, mass-deleted project files and copied them to USB on their last day. You have the MFT/USN record, the LNK evidence and the change calendar. Your job is NOT to confirm the accusation — it is to reconstruct what actually happened. A forensic analyst clears people as often as they implicate them.
What you will be able to do
- Reconstruct the deletion event from filesystem truth, not from the accusation.
- Test the USB-copy claim against the artifacts that would show it.
- Reach the verdict the evidence supports — including innocence.
Log AnalysisWindows SecurityAnalyst Reporting
Sign in to start this lab.
Sign in