USB insider threat challenge
An employee used a USB stick on an unlocked company computer to steal three confidential files from the finance department (.xlsx, .docx, .pptx). After copying the files to the USB, he opened them from the flash drive to check they were copied properly.
evidence Link : https://drive.google.com/file/d/1XpujzY3gaN0UTsB7vmRqrDZmFzSawasF/view?usp=sharing

Based on the scenario above and the provided evidence please answer the following questions. for every question requires answer format don't include "(" or ")" in your answer just type the answer itself.

Sign in to Google to save your progress. Learn more
Email *
What is the computer name? *
2 points
what is the drive letter assigned to the USB drive ?
*
2 points
what is the make and serial number of the connected USB stick ? answer format (make model , serial number) *
2 points
what are the filenames of the 3 files copied to USB? answer format (filename1.extension, filename2.extension, filename3.extension ) *
2 points
what is the MFT record number of the PPTX file from its original path on the unlocked computer? 
*
2 points

Referring to the 3 files copied, what is the parent path of the files?  (full path)

 *
2 points
Examining the provided evidence, how many times Admin user click on start button?
*
2 points
Which user was logged in when the usb drive connected, please specify also the volume GUID of the flash drive? answer format (username,volumeguid) example (john,{5d6f-d5f5-d5f5-d5f5}) *
2 points
What is the last removal date and time of the USB drive? answer format (date MM-DD-YYY,Time 24Hr 00:00:00) example (05-08-1990,23:25:15) *
2 points

What is the number of partitions and total sectors of every partition on the connected flash drive? answer format (number,number) example (3,5698458455)

 *
2 points
What is the file system ID and type (e.g., FAT32, NTFS) of the USB drive? answer format (0x00,type) example (0x05,FAT16) *
2 points
What is the volume serial number (VSN) in hex of the USB drive?  answer format (only hex values without space) example (11CD11CD11CD11CD11CD11CD) *
2 points
A copy of your responses will be emailed to the address you provided.
Submit
Clear form
Never submit passwords through Google Forms.
reCAPTCHA
PrivacyTerms
This content is neither created nor endorsed by Google. - Terms of Service - Privacy Policy

Does this form look suspicious? Report

Google Forms