Forensic Evidence Examination
A verified working-copy examination that turns three lab-created artifacts into a bounded, reviewable timeline.
Original and working-copy hashes matched; three artifacts supported two qualified findings.
The examination question
Do the supplied artifacts support a download-to-scheduled-task sequence? The question is deliberately narrow so every conclusion can point back to a file and timestamp.
Integrity before interpretation
The evidence package was hashed, copied to a temporary working location, hashed again, and examined only after both SHA-256 values matched. A mismatched hash or unsafe archive path stops the workflow before artifact parsing.
Verified SHA-256: 409bd208bf9a794f61e72176cc19c713cb81abb29e7b0006612075fed2c64cba
What the artifacts support
- 18:02 UTC: browser history records a lab portal sign-in.
- 18:07 UTC: browser history records a remote-support download URL.
- 18:09 UTC: a scheduled-task artifact references that downloaded filename.
The sequence supports correlation between the supplied records. It does not prove execution, malware behavior, user intent, or attribution.
Inspect the evidence
Paraben E3 classroom experience
I used Paraben E3 in class. That owner-confirmed tool experience is part of my forensic foundation; the reproducible case above is new, independent portfolio work rather than a recreated or recovered classroom assignment.
Method foundation
Chuck Easttom's Digital Forensics, Investigation, and Response, Fourth Edition informed the high-level approach: preserve integrity, minimize handling of original evidence, plan the analysis, document methods and connect findings to artifacts. This case does not reproduce textbook content or claim that its fixture came from the book.
Academic foundation
Completed coursework: IST 5250 Incident Handling & Cyber Investigation and IST 4210 Advanced Networking & Security (Fall 2024). E3 classroom use is separately confirmed by me.
Scope
All artifacts are lab-created and represent no real person, device, organization or incident. The finding labels are analytical cues, not legal conclusions or proof of compromise.